PCI might not be a law, but you will get large fines from who you process with, sometimes monthly!

http://www.pcistandard.com/pci-standard/card-association-fin...