Appendix C from The AI Contact Center Handbook by Sho Shimoda. Available on Amazon.
How to read this appendix
This appendix collects the compliance reference material referenced throughout the book. The PCI DSS checklist is the workhorse for anyone taking card payments over the phone. The merchant-level breakdown resolves the perennial confusion about which validation obligations actually apply. And the global privacy summary gives a working comparison of the five regimes every multinational CX operation should understand.
None of this replaces qualified legal or compliance counsel. But if you cannot answer the questions here, you are not ready to have the conversation with counsel.
C.1 The 12-Step PCI DSS v4.0 Checklist
The Payment Card Industry Data Security Standard, version 4.0, was published in March 2022 and became mandatory for all assessments after March 31, 2024. Its structure is unchanged from prior versions — twelve principal requirements organized into six goals — but the specific controls under each requirement have been substantially updated, particularly around authentication, encryption, and continuous evaluation.
| Goal | # | Requirement | What it means for a contact center |
|---|---|---|---|
| 1. Secure network | 1 | Install and maintain network security controls | Firewalls, segmentation between the cardholder data environment (CDE) and everything else, documented rulesets, quarterly review. Segmentation is what decides whether your voice AI is in scope. |
| 2 | Apply secure configurations to all system components | No default passwords, no unnecessary services, documented baselines for every system class. Forgotten voice gateways and session border controllers are where audit findings live. | |
| 2. Protect account data | 3 | Protect stored account data | Encryption at rest, defined retention, documented destruction. v4.0 tightens the rule on sensitive authentication data: essentially, do not store it at all after authorization. |
| 4 | Protect cardholder data with strong cryptography in transit | TLS 1.2+ across all networks, no fallback to older protocols. Voice calls carrying DTMF card entries count as transmission. | |
| 3. Vulnerability mgmt | 5 | Protect all systems from malicious software | Anti-malware on all affected systems. On-device AI models may need to be excluded from certain scans — document the exclusion. |
| 6 | Develop and maintain secure systems and software | Vulnerability management with defined risk-rating and remediation timeframes. Custom code — including AI prompt templates and system prompts — is reviewed for security issues before deployment. | |
| 4. Strong access control | 7 | Restrict access by business need to know | Role-based access, least privilege, documented approval. For AI systems, the AI itself is a system component and its access rights need to be defined and constrained. |
| 8 | Identify users and authenticate access | MFA is required for all access to the CDE. Under v4.0 this specifically includes all administrative access, not just remote access — mandatory since 2024. | |
| 9 | Restrict physical access to cardholder data | Physical security of servers, workstations, and any location where cardholder data could be accessed. For remote-work contact centers, cascades into home-office requirements for agents handling payments. | |
| 5. Monitor & test | 10 | Log and monitor all access | Comprehensive audit logging, retention for at least 12 months (3 months immediately available). New in v4.0: automated log review with SIEM tooling. |
| 11 | Test security regularly | Quarterly external ASV scans, quarterly internal scans, annual penetration testing (internal and external), post-change validation. Wireless AP detection required at least every 3 months. | |
| 6. Security policy | 12 | Support information security with organizational policies and programs | Documented, published, communicated security policy, reviewed at least annually. Risk assessment. Security awareness training. Incident response plan tested at least annually. |
The practical takeaway for a voice AI deployment: your AI is in PCI scope unless you can prove otherwise, and the controls that prove otherwise are network segmentation, pause-and-resume payment capture with DTMF masking (see Chapter 9), and rigorous validation that no cardholder data ever reaches the AI's inputs, logs, or training pipelines.
C.2 PCI Merchant Levels 1–4
The validation requirements you actually have depend on your merchant level, which depends on your annual transaction volume. The levels have historically been set by the individual card brands with generally consistent thresholds; the numbers below are Visa's, which most other brands follow.
| Level | Threshold | Validation | Typical annual cost |
|---|---|---|---|
| 1 | >6M transactions/year across all channels, or any breach-designated merchant, or brand-designated Level 1. | Annual Report on Compliance (ROC) by a QSA or ISA. Quarterly ASV scans. Executive-signed AoC. | $75K–$250K validation, plus ~$100K+ for the contact center scope. |
| 2 | 1M–6M transactions/year. | Annual SAQ (or on-site ROC at some brands' discretion). Quarterly ASV scans. AoC. Some acquirers require QSA-signed SAQ. | SAQ D (~330 controls) is typical for any card-taking contact center presence. |
| 3 | 20K–1M e-commerce transactions/year. | Annual SAQ (typically SAQ A or A-EP for third-party payment pages). Quarterly ASV scans. AoC. | — |
| 4 | <20K e-commerce or <1M total. | Annual SAQ (variant depends on environment). Quarterly ASV scans usually required by acquirer. | Set by the acquiring bank rather than centrally by the card brands. |
The other operational point: SAQ eligibility is narrower than most merchants realize. If your contact center takes cards over the phone and any of your systems can touch card data — even for the milliseconds it takes to pass through — you are almost certainly ineligible for the simpler SAQs (A, A-EP, B, C-VT) and must complete SAQ D. Pause-and-resume architectures (Chapter 9) are the primary technical mechanism for reducing SAQ D scope back toward the simpler variants.
C.3 Global Privacy Mandates
The five regimes below cover roughly 90% of the personal data any multinational contact center is likely to touch. Each is summarized here to the level of detail a CX leader should be able to speak to unaided.
| Regime | Scope | Ceiling penalty | Contact-center hot spot |
|---|---|---|---|
| GDPR (EU) | Personal data of EEA residents, wherever processed | €20M or 4% global turnover | Cross-border transfer of EU call recordings to U.S.-based AI services is a top-scrutiny data flow. |
| CCPA / CPRA (California) | Businesses collecting CA residents' PI over defined thresholds | $2.5K per violation, $7.5K intentional, plus $100–$750 per consumer statutory damages | CA residents can request deletion of recordings and transcripts, including from AI training data. |
| TCPA (U.S. federal) | Telemarketing, auto-dialed, prerecorded, unsolicited SMS | $500 per violation, $1,500 willful; class actions in the hundreds of millions | Outbound AI voice calls are treated as prerecorded calls — require prior express written consent. |
| LGPD (Brazil) | Any operator processing Brazilian residents' data | Up to 2% of Brazilian revenue, capped at R$50M per infraction | 2022 enforcement focused on breach response failures rather than collection or consent issues. |
| APPI (Japan) | Business operators in Japan; extraterritorial for JP-resident data | Up to ¥100M (~$700K); criminal penalties for individuals in some cases | Voice-recording notification is culturally and legally expected at the start of every interaction. |
GDPR — General Data Protection Regulation (EU)
Key principles. Lawfulness (consent, contract, legal obligation, vital interests, public task, or legitimate interests). Purpose limitation. Data minimization. Accuracy. Storage limitation. Integrity and confidentiality. Accountability.
Key obligations. DPO appointment for high-volume or sensitive processing. DPIA for high-risk processing (voice AI qualifies). Data subject rights (access, rectification, erasure, portability, objection, restriction). 72-hour breach notification. Cross-border transfer restrictions (SCCs, adequacy decisions, BCRs).
CCPA / CPRA — California Consumer Privacy Act (as amended)
Thresholds. Annual gross revenue over $25M, or annual processing of PI of 100K+ CA residents, or 50%+ of revenue from selling/sharing PI.
Key rights. Right to know, delete, correct, opt out of sale or sharing, limit use of sensitive PI, non-discrimination for exercising rights.
Key obligations. Privacy notice at collection. Response to consumer requests within 45 days. Contracts with service providers. Data protection assessments for high-risk processing.
TCPA — Telephone Consumer Protection Act (U.S.)
Key rules. Prior express consent for auto-dialed or prerecorded calls to cell phones. Prior express written consent for auto-dialed or prerecorded telemarketing to any number. 8 AM–9 PM local time. Do-not-call registry compliance. Caller ID transmission requirements.
Key AI implication. The FCC clarified in 2024 that AI-generated voice calls are subject to the same restrictions as prerecorded calls. Outbound AI calling requires prior express written consent from the recipient. This is the single most common area where AI-enabled outbound programs run into legal trouble.
LGPD — Lei Geral de Proteção de Dados (Brazil)
Key principles. Purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, accountability. Ten lawful bases (broader than GDPR's six).
Key obligations. DPO (Encarregado). Data protection impact assessment for high-risk processing. Data subject rights parallel to GDPR. Cross-border transfer restrictions. Regulator: ANPD.
APPI — Act on the Protection of Personal Information (Japan)
Key principles. Specified purpose of use, consent, proper acquisition, appropriate management, third-party transfer restrictions. The 2022 amendments strengthened data subject rights and cross-border transfer obligations and added a mandatory breach notification requirement.
Key obligations. Notification of purpose of use at acquisition. Consent for "special care-required personal information." Notification and often consent for cross-border transfer. Response to data subject access requests. Regulator: Personal Information Protection Commission (PPC).
How to use this appendix
Reach for C.1 when scoping a PCI assessment or arguing about whether the AI is in scope. Reach for C.2 when a colleague insists your merchant level is set by one channel rather than total volume. Reach for C.3 as the first-pass reference when a new market enters the roadmap — and treat every entry as a starting point for your privacy counsel, not a substitute.