As the Payment Card Industry's data security regulation begins to bite, Barry Mansfield examines its aims and obligations