Glossary · PCI DSS v4.0.1

SAQ — Self-Assessment Questionnaire

A Self-Assessment Questionnaire (SAQ) is a PCI SSC validation tool that lets an eligible merchant or service provider assess its own PCI DSS compliance. There are ten SAQ types in v4.0.1, each with its own eligibility criteria and set of requirements.

Find your SAQ Full glossary

What it means in practice

Which SAQ applies depends entirely on how the entity accepts and handles payment card data. Each payment channel must independently satisfy the eligibility criteria of the SAQ used for it.

Short-form SAQs (A, A-EP, B, B-IP, C, C-VT, P2PE, SPoC) all require that no account data is stored electronically. SAQ D for Merchants is the catch-all where no short form fits, and SAQ D for Service Providers is the only SAQ available to service providers.

The acquirer or payment brand is the compliance-accepting entity and can require a different validation method, including a Report on Compliance.

Not sure how this affects your assessment?

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Definitions paraphrased from the PCI DSS v4.0.1 standard and the PCI SSC Glossary of Terms, Abbreviations and Acronyms. Independent summary; not endorsed by PCI SSC.