PCI DSS
The security standard any organization handling payment card data must meet, set by the card brands.
It is contractual rather than statutory, enforced through your acquiring bank and payment processor, with penalties and increased fees for non-compliance.
Scope reduction is the most valuable strategy available. Using a hosted payment page or point-to-point encrypted terminals keeps card data out of your systems entirely, which reduces a large questionnaire to a much smaller one.
Where this comes up
PCI DSS sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.