Anyone accepting card payments commits to PCI DSS through the contract with the acquirer. The standard is not law but is enforced contractually; breaches can lead to fees and, in the event of an incident, liability.
Twelve requirements
PCI DSS is organised into twelve requirements, from network security and protection of stored card data through access control and logging to regular testing and a security policy. Version 4.0 added, among other things, stricter authentication requirements and controls on scripts on payment pages.
Keeping scope small
The most important lever for shops and apps is not to touch card data at all. Leaving card entry entirely to a certified payment provider, for example through an embedded payment form or a redirect, reduces scope considerably and often allows a shortened self-assessment.
Relation to other rules
PCI DSS complements data protection and information security but does not replace them. For merchants with their own shop, the payment journey is also an accessibility topic. In our own products we process payments through certified providers without storing card data.