Our company is not compliant with the Payment Card Industry Data Security Standard (PCI-DSS). But all our payments are only handled by one payment gateway provider who is PCI-DSS compliant.
Am I allowed to place a PCI-DSS compliant logo on our website?
This way I'd like to point out to our customers that the transactions are safe with our payment provider and that they are PCI-DSS compliant.
Your jurisdiction's laws and your concerns may vary slightly or significantly depending on where you are, so it would be wise to ask a local attorney.
In the United States, most legal concerns would be addressed if a company doing that were to (1) check with an industry body about whether industry practice allows that, (2) include a note of explanation somewhere even if it is a small statement saying "Your payment is processed by our PCI-DSS compliant payment vendor" or something like that, to make sure your customers are not misled, and (3) be sure you have proof that you have the permission of the person or entity who owns the copyright in the logo.
In most industries a customer will not even know what PCI-DSS is, so it may not be a helpful logo from a marketing standpoint. You may also be taking on additional liability or hurting your chances at trial in the event that there is ever a lawsuit over a data breach in which your payment provider's PCI-DSS compliance is called into question. It seems unlikely this would be an issue in practice, but it is certainly possible.
