As pointed out, the PCI DSS typical recognizes that not all businesses have equal risk variables or equivalent ability to roll out security infrastructure. If your Group is little, ask for support if required. Scaled-down businesses will probably be influenced by GDPR, some much more noticeably than others. Limit use https://www.hindustaniexpress.in/nathan-labs-advisory-ensuring-hipaa-compliance-certification-in-the-usa/