PCI DSS Compliance for Small Businesses: A Plain-English Guide

If you accept credit or debit cards, you’ve probably seen an email or a line on your statement about PCI compliance. Maybe there’s a monthly “non-compliance fee,” or your processor wants you to fill out a questionnaire you don’t understand. It’s confusing, but for most small businesses it’s manageable once you know 3 things: what level you are, which questionnaire applies, and how to keep card data off your systems.

This guide explains PCI DSS in plain language for owners of shops, restaurants, service businesses and online stores.

What PCI DSS is and who it applies to

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for anyone who stores, processes or transmits cardholder data. It’s managed by the PCI Security Standards Council (PCI SSC), which was founded by the major card brands.

Key points:

• It’s a contractual requirement, not a federal law. Your agreement with your merchant bank (acquirer) or payment processor requires you to comply. Card brands and acquirers enforce it, and some states reference it in their own laws.
• It applies to every merchant that accepts cards, regardless of size.
• The current version is PCI DSS v4.0.1, published in June 2024 as a limited revision with clarifications and no new requirements. PCI SSC retired v4.0 on December 31, 2024. Requirements that were “future-dated” in v4.x became mandatory after March 31, 2025.

This is not legal advice. Your processor agreement is the place to confirm your obligations.

The 12 requirements in brief

PCI DSS is organized into 12 principal requirements under 6 goals:

The good news: a small merchant with a well-designed payment setup may only need to answer a small subset of these.

Merchant levels: how big you are

Card brands sort merchants into levels by annual transaction volume, and the level determines how you validate compliance. Visa’s published definitions are the most commonly cited:

Mastercard, American Express and Discover publish their own criteria, and brands revise their definitions from time to time. Most small businesses fall into the lowest level, where your acquirer sets the exact validation requirements. Visa also notes that a merchant that suffers a data compromise may be moved to a higher validation level.

SAQ types: which questionnaire fits you

The Self-Assessment Questionnaire (SAQ) is how most small merchants validate compliance. Which SAQ you use depends on how you accept payments, not how big you are. PCI SSC says to contact your acquirer or the card brands if you need help determining the right SAQ.

A note for online stores using SAQ A

PCI SSC updated SAQ A in January 2025. The revised version, effective March 31, 2025, removed requirements 6.4.3, 11.6.1 and 12.3.1, which deal with payment page script security. In their place, it added an eligibility criterion: merchants must confirm their site isn’t susceptible to attacks from scripts that could affect their e-commerce systems. If you run an online store, ask your e-commerce platform or payment provider how they support this.

Key takeaway: The less card data touches your systems, the smaller your SAQ and the lower your risk. Choosing the right payment setup is the biggest PCI decision a small business makes.

How payment processors reduce your scope

“Scope” is the set of people, systems and processes that touch cardholder data. Shrinking scope is the smartest way to make PCI manageable. Modern processors help in several ways:

• Hosted checkout and embedded payment fields. The card form is served by the processor, so card numbers never pass through your web server. That’s what makes SAQ A possible.
• Tokenization. Instead of storing card numbers, you store a token that’s useless to thieves. Recurring billing and card-on-file work without you keeping the real number.
• Point-to-point encryption (P2PE). Validated P2PE terminals encrypt the card the moment it’s swiped, tapped or dipped. Your network never sees readable card data.
• PCI-approved card readers. PCI SSC’s small merchant guidance recommends using terminals from its approved device lists and validated payment software.
• Compliance portals. Many processors offer an online tool that walks you through the right SAQ and schedules any required scans.

Ask your processor these questions:

1. Which SAQ do you expect me to complete?
2. Are your terminals P2PE-validated?
3. Is your online checkout hosted or embedded so card data never touches my server?
4. Do you tokenize stored cards?
5. Do I need quarterly vulnerability scans, and do you provide them?
6. Is there a non-compliance fee, and how do I avoid it?

Everyday security habits PCI expects

Even with a small SAQ, these habits protect you and line up with PCI requirements:

• Never write down or email card numbers. If you take phone orders, key them straight into a virtual terminal or a P2PE device.
• Don’t store card data you don’t need. PCI SSC’s Guide to Safe Payments says the best protection is not storing card data at all.
• Inspect terminals for tampering. Keep a list of devices with photos and check for skimmers or swapped devices regularly.
• Change default passwords on routers, POS systems and Wi-Fi. Use unique logins for each employee.
• Use multifactor authentication for remote access and admin accounts. Passkeys are a strong option where supported.
• Keep your POS and computers updated and run reputable anti-malware.
• Separate guest Wi-Fi from the network your payment devices use.
• Train staff to recognize phishing and social engineering, such as fake “processor support” calls.

For a broader security program, the NIST Cybersecurity Framework provides a free structure that complements PCI.

Step-by-step: getting compliant this month

1. List every way you accept cards: counter terminals, mobile readers, online store, phone orders, invoices.
2. Map each to your processor or provider. Note the device model and whether it’s P2PE or a SPoC solution.
3. Ask your acquirer or processor which merchant level you’re in and which SAQ applies.
4. Reduce scope first. Move to hosted checkout, tokenization or P2PE terminals if you aren’t using them already.
5. Complete the SAQ honestly. Many processors offer a guided portal.
6. Run quarterly scans with an Approved Scanning Vendor if your SAQ requires them.
7. Sign the Attestation of Compliance and submit it as your acquirer instructs.
8. Set a reminder to repeat validation every year, and again any time you change how you take payments.

Running a restaurant or shop? Our guides on how technology is changing restaurants and retail tech trends cover modern POS and payment options that make this easier.

Conclusion

PCI DSS sounds intimidating, but for most small businesses it comes down to a simple strategy: keep card data off your systems by using a compliant processor, hosted checkout and validated card readers, then complete the SAQ that matches your setup each year. Ask your processor the right questions, fix the basics like passwords and updates, and you’ll be both safer and compliant.

Sources

• PCI SSC: Just Published: PCI DSS v4.0.1 — v4.0.1 release and v4.0 retirement date
• PCI SSC: Adopt the future-dated requirements of PCI DSS v4.x — March 31, 2025 effective date
• PCI SSC: PCI DSS v4: What’s New with Self-Assessment Questionnaires — SAQ types and where to get help choosing one
• PCI SSC: Important updates for merchants validating to SAQ A — January 2025 SAQ A changes
• PCI SSC: Guide to Safe Payments for small merchants — not storing card data, approved devices and terminal inspection
• Visa: Compliance validation and merchant levels — merchant level criteria and validation requirements