PCI Compliance for Small Business

“PCI” comes up when you sign up with a processor or when a bank sends a compliance reminder. This guide summarizes what the PCI Security Standards Council (PCI SSC) publishes for small merchants, as read on 2026-10-16. It is general information, not legal advice, and your obligations depend on your setup and your merchant bank.

What PCI DSS is

The Council’s Guide to Safe Payments describes PCI DSS as a set of security requirements that can help small merchants protect customer card data. Examples of card data it lists are the primary account number (PAN) and the three- or four-digit card security code. The Guide says that fallout from a breach can include lost customer trust, financial penalties and damages from lawsuits, and that a business may lose the ability to accept payment cards.

Understand your payment system first

The Guide defines a payment system as the entire process for accepting card payments: a payment terminal, an electronic cash register, other connected devices or systems (for example Wi-Fi or a PC used for inventory) and the connections to a merchant bank. It describes three main ways to sell: a person pays by card in your shop, a person pays on your website, or a person gives card details by phone, mail or fax.

The more features your payment system has, the more complex it is to secure. The Guide tells merchants to think carefully about whether they need extras such as Wi-Fi, remote access software, internet-connected cameras or call recording systems, because each can give criminals easy access to card data if not properly configured and managed.

For online selling, the Guide says handling of card data may be managed exclusively by the merchant, partially managed with a third party, or wholly outsourced to a third party, and that using a wholly outsourced third party is, most times, the safest option, provided the third party is PCI DSS validated.

The Self-Assessment Questionnaire (SAQ)

The Council says there are multiple SAQs to match different merchant scenarios, depending on how a merchant stores, processes or transmits cardholder data and sensitive authentication data. To work out which applies, it points to its SAQ Instructions and Guidelines, and it says merchants should consult the entity that accepts the SAQ, typically their acquirer (merchant bank) or the payment brands, to find out whether they are required to submit one and which one fits their environment. SAQ D for Service Providers is only for service providers; all other SAQs are for merchants.

So the practical first step is a short email to your processor or merchant bank: “Which SAQ applies to my setup, and when is it due?”

Twelve security basics, from easiest to hardest

The Guide organizes these from easiest and least costly to more complex and costly, and rates each on cost, ease and risk reduction:

1. Use strong passwords and change default ones. The Guide says a strong password has seven or more characters mixing upper and lower case letters, numbers and symbols, and that each employee should have their own login.
2. Don’t give hackers easy access to your systems.
3. Use anti-virus software.
4. Scan for vulnerabilities and fix issues.
5. Use secure payment terminals and solutions.
6. Protect your business from the internet.
7. Make your card data useless to criminals, through encryption and tokenization.
8. Protect your card data and store only what you need.
9. Inspect payment terminals for tampering.
10. Install patches from your vendors.
11. Use trusted business partners and know how to contact them.
12. Protect in-house access to your card data.

On terminals, it says to make sure your payment terminal is on the List of PCI Approved PTS Devices and supports EMV chip, that payment software is on the List of PCI Validated Payment Applications, and that payment terminals that are part of a PCI-listed point-to-point encryption (P2PE) solution provide the best assurance about the quality of encryption. For internet protection, it says not to use the payment device for anything else (such as web browsing or email), to keep payment systems off the Wi-Fi offered to customers, to use a properly configured firewall, and, if you use a virtual terminal, not to attach an external card reader to it.

Questions to ask your vendors

The Council’s Questions to Ask Your Vendors lists types of vendors and what to look for. For payment processors, e-commerce payment service providers and payment gateways, it says to ask for their PCI DSS Attestation of Compliance and whether the assessment included the service you use, and to check whether they appear on Mastercard’s list of compliant service providers or Visa’s Global Registry of Service Providers. For terminal vendors it says to look for devices on the List of PCI Approved PTS Devices, and for installers it says to ask whether the vendor is a PCI Qualified Integrator or Reseller (QIR).

Where this fits with the rest of your setup

Choose a provider with your PCI questions in mind: see how to accept credit card payments for the setup order, and payment gateway vs merchant account for who handles your card data at each step. If you take payments on a phone, see contactless payments and Tap to Pay. Fraud and disputes are a separate risk; see how to prevent chargebacks.

What we did not verify

We did not read the PCI DSS standard itself or the SAQ documents, so this guide gives no requirement-by-requirement detail and no deadlines. We also did not verify fees that processors charge for PCI programs or non-compliance, and we did not research breach notification laws. The Guide is dated April 2024 and the vendor questions August 2018, so check the Council’s pages for newer versions.