Whilst PCI compliance is not a legal requirement, non-compliant merchants will be subject to severe fines and may be rejected by acquirers without it. If you are using a pci-compliant iframe to take payments, you will still be required to fill out an SAQ self-assessment questionnaire.