Free guide · PCI DSS v4.0.1

PCI compliance for small businesses

Most small merchants never need the full PCI DSS. If you outsource payment acceptance completely and store no card data electronically, you are usually eligible for a short-form SAQ — often SAQ A for e-commerce or SAQ B/B-IP/P2PE for card-present — which is a fraction of the work of SAQ D. The single biggest lever is reducing what your own systems touch.

Find your SAQ All guides

Start by shrinking scope

Scope, not company size, decides how much PCI DSS applies to you.

Use a payment provider's hosted page or full redirect so every element of the payment page comes only and directly from them — that is the SAQ A criterion.

For card-present, use standalone terminals, and prefer a PCI-listed validated P2PE solution where available.

Never store card numbers in spreadsheets, CRM notes, email, order systems or call recordings.

Retire legacy stored data — electronic storage of account data rules out every short-form SAQ.

Which SAQ small merchants usually land on

SAQ A — e-commerce or MOTO with all account data functions fully outsourced.

SAQ A-EP — your own site delivers part of the payment page or controls the redirect.

SAQ B / B-IP — imprint machines or dial-out terminals, or standalone IP-connected PTS POI devices.

SAQ C-VT — one isolated computer keying transactions into a provider-hosted virtual terminal.

SAQ P2PE / SPoC — a PCI-listed validated P2PE or SPoC solution.

What you still have to do

Even the shortest SAQ carries real obligations. These are the ones small merchants most often miss.

Requirement 12.8: a register of your payment providers, written agreements and annual checks of their compliance status.

Requirement 9.5.1: a POI device list and periodic tamper inspections, if you take cards in person.

Requirements 6.4.3 and 11.6.1: payment page script management and change detection, if you run e-commerce.

Security awareness training, an incident response plan, and unique credentials with MFA where required.

Who you report to

Your acquirer or payment brand is the compliance-accepting entity — confirm the SAQ and the submission route with them.

A self-assessment done for readiness is not the same as a validated, signed Attestation of Compliance.

If they mandate a Report on Compliance, self-assessment is off the table regardless of your size.

Turn the reading into an answer

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Written by Haumaru Whānau QSAs. PCI DSS content paraphrased from PCI DSS v4.0.1 and PCI SSC published guidance; payment brand programmes are set by the brands and your acquirer. Independent summary; not endorsed by PCI SSC.