Which regulation is specifically mandated to payment account data security?

GLBA (Gramm-Leach-Bliley Act) primarily focuses on financial institutions' obligation to explain their information-sharing practices to customers and to safeguard sensitive data.

PCI DSS is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Compliance with PCI DSS is mandatory for entities handling cardholder data to protect against payment card fraud.

EU GDPR (General Data Protection Regulation) is a broad data privacy and security law concerning the personal data of EU citizens, not specifically payment account data security as its primary mandate.

SOX (Sarbanes-Oxley Act) addresses corporate governance and financial reporting accuracy, aiming to prevent corporate accounting scandals, rather than directly mandating payment account data security.