Although PCI compliance isn’t mandated by law, failing to comply with PCI DSS can result in investigations, fines, and penalties.