All entities (including merchants) that transmit, process or store payment card data must be compliant with PCI DSS.