Nevada's PCI DSS Statute: How NRS 603A.215 Turned a Card Industry Standard Into State Law

What NRS 603A.215 Requires

Nevada's statute book names a private industry standard as the security rule for one class of businesses.NRS 603A.215 has five subsections, and each does a different job. Subsection 1 is the payment card clause. Subsection 2 is an encryption mandate for data collectors outside subsection 1. Subsection 3 is a limit on damages. Subsection 4 lists two activities the section does not reach, and subsection 5 holds the definitions, including the only definition of encryption in the security half of chapter 603A.

Who the section reaches turns on two defined terms. A "data collector" under NRS 603A.030 is any governmental agency, institution of higher education, corporation, financial institution, retail operator or other business entity or association that "handles, collects, disseminates or otherwise deals with nonpublic personal information," for any purpose. Both operative subsections add the words "doing business in this State." The information protected is "personal information" as NRS 603A.040 defines it, the same definition that drives the chapter's breach notice rule.

From Encryption Bill to PCI Mandate: The 2009 Enactment

The section began as Senate Bill 227, introduced by Senator Wiener on March 13, 2009 and summarized as revising "certain provisions concerning identity theft." As introduced, its first section said only that a data collector "shall not" transfer personal information electronically outside its secure system, or move a data storage device beyond its controls, without encryption. There was no reference to payment cards.

The enrolled bill reads differently. Its title became an act "requiring the compliance with certain standards or the use of encryption," and a new first subsection imposed the Payment Card Industry Data Security Standard on data collectors that accept a payment card. The encryption rule moved to subsection 2 and was limited to a data collector "to whom subsection 1 does not apply." The enrolled text also added the two exemptions now in subsection 4 and the definitions of payment card and telecommunication provider. Section 2 of the bill repealed NRS 597.970, an earlier rule that barred a business from transferring a customer's personal information electronically outside its secure system without encryption. Section 3 set the effective date: January 1, 2010.

PCI DSS Written Into State Law

Subsection 1 applies when a data collector doing business in Nevada "accepts a payment card in connection with a sale of goods or services." Payment card takes its meaning from NRS 205.602: a credit card, charge card, debit card or any other card that is issued to an authorized card user and allows the user to obtain credit, money, goods, services or anything of value. The duty runs "with respect to those transactions," which limits the clause to card transactions rather than to everything the data collector holds.

Two phrases make the reference move over time. The standard is "the current version" of the PCI DSS "as adopted by the PCI Security Standards Council or its successor organization," and compliance is due "not later than the date for compliance set forth" in the standard or by the Council. The Legislature has not had to amend the section to track new versions, because the text delegates both the content and the calendar to the Council.

The Council's own publications show how that works in practice. Its June 2024 announcement of PCI DSS v4.0.1 describes it as a limited revision with no added or deleted requirements, states that v4.0 would be retired on December 31, 2024, leaving v4.0.1 as "the only active version of the standard supported by PCI SSC," and confirms that the revision did not change the March 31, 2025 effective date for the requirements introduced in v4.0. Read against NRS 603A.215(1), the version and dates the statute refers to are the ones the Council sets.

The Encryption Mandate for Everyone Else

Subsection 2 contains two prohibitions. Under paragraph (a), a covered data collector may not transfer personal information "through an electronic, nonvoice transmission other than a facsimile" to a person outside its secure system unless it uses encryption to secure the transmission. Under paragraph (b), it may not move a data storage device containing personal information beyond its logical or physical controls unless it uses encryption to secure the information.

Paragraph (b) was widened by Senate Bill 267 of 2011, Chapter 354, approved June 13, 2011. The Legislative Counsel's digest describes the change: the device rule now also reaches a data storage device "used by or is a component of a multifunctional device," and the relevant controls include those of "a person who assumes the obligation of the data collector to protect personal information." The definition of multifunctional device added in subsection 5 names printers, copiers, scanners, facsimile machines and electronic mail terminals among the functions such a machine may combine.

The two paragraphs cover movement, not storage at rest. Neither paragraph addresses data that stays inside the secure system or on a device kept within the data collector's controls. The facsimile carve-out is also narrower than it first appears: subsection 5(c) defines facsimile as a transmission between two dedicated fax machines, or conforming fax modems, and excludes "onward transmission to a third device after protocol conversion."

The statute frames subsections 1 and 2 as alternatives at the level of the data collector, not the transaction. Subsection 2 applies to a data collector "to whom subsection 1 does not apply." The text does not separately address the non-card records of a data collector that also accepts cards.

What Counts as Encryption

The definition sits in NRS 603A.215(5)(b) itself; the chapter's general definitions section for the security provisions, NRS 603A.010, lists only three defined terms and encryption is not among them. Under the section's definition, encryption means protecting data "in storage or in transit" using three things. The first is a technology adopted by an established standards setting body, including the Federal Information Processing Standards issued by NIST, that renders data "indecipherable in the absence of associated cryptographic keys." The second is appropriate management and safeguarding of those keys under guidelines from such a body, again including NIST. The third, added in 2011, is "any other technology or method" identified in regulations adopted under NRS 603A.217.

The first two elements were in the 2009 bill as enacted. They make key management part of the definition: a technology meeting the first element without the second does not satisfy the statutory wording.

NRS 603A.217 was also created by the 2011 bill. It allows a state office, "upon receipt of a well-founded petition," to adopt regulations under the Nevada Administrative Procedure Act identifying alternative encryption methods or technologies. In 2011 that office was the Office of Information Security of the Department of Information Technology. Senate Bill 12 of 2025, Chapter 294, approved June 5, 2025 and effective July 1, 2025, renamed the Office of the Chief Information Officer as the Governor's Technology Office. Senate Bill 467 of 2025, Chapter 513, approved June 10, 2025, merged the Nevada Office of Cyber Defense Coordination with the Office of Information Security to form the Office of Information Security and Cyber Defense. The current text of NRS 603A.215 and 603A.217 carries those names.

Exemptions and the Liability Shield

Subsection 4 excludes two activities from the whole section. One is a telecommunication provider "acting solely in the role of conveying the communications of other persons," over any medium. The other is data transmission over a secure, private channel either for approving or processing negotiable instruments, electronic fund transfers or similar payment methods, or for issuing reports on account closures due to fraud, substantial overdrafts, ATM abuse or related customer information.

Subsection 3 provides that a data collector "shall not be liable for damages" for a breach of the security of the system data if it is in compliance with the section and the breach was not caused by the gross negligence or intentional misconduct of the data collector, its officers, employees or agents. Both conditions appear in the 2009 bill as introduced and as enrolled.

By its terms the shield addresses damages. It does not mention the Attorney General's or a district attorney's power under NRS 603A.290 to seek a temporary or permanent injunction against a violation of NRS 603A.010 to 603A.290, or NRS 603A.260, which classifies such a violation as a deceptive trade practice for the purposes of chapter 598.

How It Sits Beside the Security Duty in NRS 603A.210

NRS 603A.210 states the general rule for every data collector maintaining records with a Nevada resident's personal information: reasonable security measures against unauthorized access, acquisition, destruction, use, modification or disclosure, with a contract term passing the same obligation to recipients. NRS 603A.215 is narrower and more specific. It names the standard for card transactions and the technique for data leaving the data collector's control, but it does not replace the general reasonableness duty for everything else.

Subsection 4 of NRS 603A.210 adds a deemed-compliance rule: a data collector subject to a state or federal law requiring greater protection, and in compliance with it, is deemed to comply with section 210. No equivalent sentence appears in NRS 603A.215. Two chapter-wide provisions apply to both sections: NRS 603A.100(1) excludes information maintained or transmitted under Nevada's health information exchange provisions at NRS 439.581 to 439.597, and NRS 603A.100(3) makes any waiver of NRS 603A.010 to 603A.290 void and unenforceable.

Frequently Asked Questions