Which of the following is NOT considered a service provider?

• A. Data Center hosting providers
• B. Payment gateways
• C. Telecom providers (only communications link)
• D. ISOs

Answer: (C)

In PCI DSS terms, a service provider is an entity that stores, processes, or transmits cardholder data on behalf of a merchant, or that could affect the security of cardholder data. Data center hosting providers, payment gateways, and ISOs all fit that role because they either handle card data directly or influence how it’s secured. A telecom provider that only supplies the communications link and does not access, process, or store cardholder data isn’t performing those functions and therefore isn’t considered a service provider. The data simply travels through the network, often in encrypted form, without the provider handling the data itself.