When Merchants sign a contract that has a payment processor, they agree to be subject to fines whenever they fail to maintain PCI DSS compliance. The data defense authorities, Functioning together in the eu Information Defense Board, need to make sure the data safety principles during the EU are used https://www.nathanlabsadvisory.com/blog/nathan/achieving-soc-2-compliance-a-crucial-step-towards-data-security/