Local Government Reorganisation (LGR) takes several predecessor councils and combines them into one. On day one, a single organisation takes on the payment methods, suppliers and card data handling that used to be spread across many. Each predecessor will have made its own choices about these.
A predecessor's compliance position does not pass to the new entity on its own. A merger can therefore leave a council exposed while attention is on structure, staffing and systems. This guide is for local authorities going through LGR, whether you are a predecessor council planning ahead or a new unitary already in the middle of it. It covers where the gaps appear, what the standard now expects, and a sensible order for working through the merger.
In this guide:
The PCI compliance gap in unitary data protection and mergers
Gaps in PCI compliance rarely come from one dramatic failure. They build up through small, reasonable decisions made by teams who were never asked to look at the whole picture. Three patterns show up most often.
Decentralised departments
Individual teams such as parking, council tax and licensing adopt different payment methods over time. Each choice may have made sense locally. Without a uniform security review, though, the council ends up with payment routes that nobody has mapped from start to finish.
Unreliable third-party systems
Predecessor councils usually arrive with a mix of third-party gateways, each with its own contract, configuration and renewal date. Under UK data protection law, the new unitary is accountable for how that data is handled. Relying on inherited providers without checking them leaves the organisation exposed. Access PaySuite provides payment solutions built for unitaries, so consolidating onto fewer, well-governed routes is a realistic option to consider.
Aggregated transaction volumes
Merging councils puts more payment information in one place. Systems built for a smaller organisation may not have been designed to store or process that volume in a compliant way. If those systems have not been reviewed, sensitive cardholder data could be at risk.
Councils searching for pci uk compliance guidance, or pci compliance for local authorities, are working to the same global standard, PCI DSS. The real question is less about where a council sits and more about how its payment environment is built. Strong unitary data protection starts with knowing exactly where card data goes, and who or what can touch it.
The wider challenge is covered in our guide to unitary payment challenges. For background on the standard itself, see our pci compliance blog.
Why PCI compliance matters more under LGR
The main risk in LGR is simple to describe. Predecessor councils bring their payment systems, suppliers and PCI accreditations with them, and none of those were built with the merger in mind. Each one made sense for its own council. Combined, they create overlapping routes for card data, and each route needs its own answer.
That work lands on internal teams who are already stretched by the merger itself. Treating payments as a separate workstream, and solving them before the merger date rather than after, is the most reliable way to avoid PCI compliance issues during LGR. Leaving payments until late in the plan leaves less time to fix what an audit finds.
The standard has also moved on. PCI DSS v4.0 was published in March 2022, and its future-dated requirements became mandatory on 31 March 2025. A merger plan built on older assumptions may therefore be out of date before it starts.
Councils working through the wider picture will find the unitary authorities sector page useful.
Steps to ensure PCI compliance for unitaries
Unitaries can achieve PCI compliance effectively by working through these steps in order. Each step makes the next one simpler to complete.
1. Audit payment channels
Map every point where cardholder data enters the combined authority's network. Include online forms, telephone payments, face-to-face terminals, direct debit set-up and any payment page hosted by a supplier. A channel you have not mapped is a channel you cannot protect.
2. System consolidation
Replace fragmented legacy software with a centralised income management system built for local government. Fewer systems mean fewer places for card data to sit, fewer contracts to review and a single route for security updates. Our income management area sets out how payments can be brought together.
3. Policy alignment
Standardise role-based access control, multi-factor authentication and annual SAQ filings across the whole merged council. Staff from every predecessor should work to the same rules from day one. Under PCI DSS v4.x, MFA is required for all access into the cardholder data environment, not only for administrators, so this rule needs to apply to every team.
How Access PaySuite can help
Taken together, the route through LGR is clear. Audit every payment channel, consolidate fragmented systems onto a platform built for local government, and align policies across the council. Each step reduces the number of places where card data needs protecting and makes the next audit easier to pass.
Access PaySuite works with councils going through LGR to bring payments together in one place. If your merger plan includes payments, talk to our team about where to start. For the wider context, read our guide to navigating LGR.
Do new unitary authorities inherit PCI compliance from predecessor councils?
No. PCI DSS compliance has to be validated for the single legal entity that the new unitary council becomes. Inherited legacy systems must be audited, consolidated or de-scoped before the council can show that it meets the standard.
How does PCI DSS v4.0 impact local government mergers?
PCI DSS v4.x tightened several controls, and the ones most relevant to a merger are authentication and monitoring. Requirement 8.4.2 requires multi-factor authentication for all access into the cardholder data environment, not just administrative access. Targeted risk analyses and continuous monitoring also apply to the merged environment, so a predecessor's older assessment cannot simply be carried forward.
How can unitaries reduce the administrative burden of PCI DSS self-assessment?
Hosted payment environments, tokenisation and secure phone payment channels can reduce the cardholder data environment a council has to protect. In the right setup, that can bring the assessment down to the shorter SAQ A questionnaire. SAQ A only applies when card processing is fully outsourced to a PCI DSS validated provider and no element of the payment page comes from the council's own website, so each channel needs checking against those conditions.
What does unitary data protection mean for councils?
It means the new council is responsible for protecting the personal and payment data it holds from the day it goes live, including data inherited from predecessor councils. In practice, that starts with knowing where the data sits, which suppliers can access it, and which systems need to be retired or secured.