Depends on your business. I didn't find it as hard as PCI compliance for instance
Unless you actually maintain full payment account numbers, PCI compliance pretty much boils down to "I pinky-swear I'm not doing anything wrong" and the rules have virtually no teeth.