If you store, transmit, or process "Account Data" you must be PCI compliant. Within the PCI DSS 2.0, "Account Data" consists of both "Cardholder Data" plus "Sensitive Authentication Data."
Cardholder Data includes:
- Primary Account Number (PAN)
- Cardholder Name
- Expiration Date
- Service Code
Sensitive Authentication Data includes:
- Full magnetic stripe data or equivalent on a chip
- PINs/PIN blocks
When the exact definition is in question, the glossary helps.
How this data is handled determines what PCI Self Assessment Questionnaire (SAQ) is applicable to your business. Unfortunately, you do not provide enough information for me to confidently identify what SAQ is applicable to your business. An excerpt from the SAQ guide should help:
SAQ A -- Card-not-present (e-commerce or mail/telephone-order) merchants, all cardholder data functions outsourced. This would never apply to face-to-face merchants.
SAQ B -- Imprint-only merchants with no electronic cardholder data storage, or standalone, dialout
terminal merchants with no electronic cardholder data storage
SAQ C-VT -- Merchants using only web-based virtual terminals, no electronic cardholder data
SAQ C -- Merchants with payment application systems connected to the Internet, no electronic
cardholder data storage
SAQ D -- All other merchants not included in descriptions for SAQ types A through C above, and
all service providers defined by a payment brand as eligible to complete an SAQ.
Additionally, the volume of transactions you process determines what PCI level is applicable to your business. While this varies between card companies slightly, they are usually very similar. Additionally, the requirements for levels vary between Service Providers and Merchants. All levels require quarterly scans. Most require annual self assessments. Finally, at level 1, you must have a Qualified Security Assessor (QSA / auditor) complete your Report on Compliance. (ROC)
While if you fall under the qualifications identified above, you will officially have to be PCI compliant on some level. Nevertheless, your bank or acquirer is going to ultimately determine your PCI reporting requirements. Do your homework and then contact your bank, they are your best bet for determining the final expectations.