PCI Compliance Basics for Small Businesses

Who writes the rules and who enforces them

PCI SSC maintains PCI DSS and the questionnaires. Its merchant FAQ says each founding payment brand (American Express, Discover, JCB International, Mastercard and Visa) has its own compliance program, and that entities should contact the brands about those programs. In January 2025 PCI SSC put it plainly: it does not define compliance requirements for any organization or set validation responsibilities; those are set by brands, acquirers, payment facilitators and other compliance enforcing entities. Visa's Core Rules (18 April 2026) show how that reaches you. Members must ensure that merchants with access to account data comply with PCI DSS, must make merchant contracts set out security responsibilities and liabilities, and must report and verify their merchants' PCI DSS compliance status to Visa at least every six months. The rules say the criteria for each merchant level are in Visa's Account Information Security Program Guide.

Small merchants are not exempt

PCI SSC's FAQ says PCI DSS applies to merchants regardless of size or transaction volume, and that small merchants often have simpler environments, with less cardholder data and fewer systems, which can reduce the compliance effort. Whether a small merchant must formally validate is decided by the payment brands, so the FAQ tells merchants to ask their acquirer or the brand. Your provider may also charge a fee if you do not submit validation; that fee is set by your provider, not PCI SSC. Our PCI non-compliance fee guide explains how to deal with it.

Scope is the part you control

How much of PCI DSS applies depends on where card data flows. Standalone terminals, hosted payment pages and embedded payment forms from a PCI DSS compliant provider keep card data off your own systems. PCI SSC's FAQ says encryption alone is generally not enough to take cardholder data out of scope, but a PCI-listed point-to-point encryption (P2PE) solution can significantly reduce the requirements that apply, without removing PCI DSS entirely. Visa's rules also forbid merchants from storing sensitive data such as the CVV2, full magnetic stripe or chip data, or PIN blocks after authorization. The questionnaire you use follows from these choices; our SAQ guide compares SAQ A, SAQ A-EP and SAQ D.

What changed with v4.0.1

PCI SSC published the SAQs for PCI DSS v4.0.1 in October 2024 and said v4.0 would be retired on 31 December 2024. Some v4 requirements were best practices until 31 March 2025. For merchants using SAQ A, PCI SSC announced in January 2025 that requirements 6.4.3 and 11.6.1 on payment page scripts, and the related risk analysis in 12.3.1, were removed from SAQ A. In their place is a new eligibility criterion: the merchant must confirm its site is not susceptible to attacks from scripts that could affect its e-commerce systems. PCI SSC stressed that the change does not remove the underlying requirements from PCI DSS. If your website embeds a payment form, ask your provider how its solution addresses this.

A yearly routine

Ask your acquirer which validation it needs from you and by when. List every way you take cards: terminals, website, phone orders, invoices and any paper forms. Confirm each vendor that handles card data is PCI DSS compliant and ask how its product affects your scope. Complete the questionnaire your acquirer confirms, fix anything marked as not in place, and keep a copy. PCI SSC's merchant resources page names common risks such as malware and phishing, weak remote access controls, weak passwords, outdated software and skimming devices, and offers free guides including the Guide to Safe Payments and Questions to Ask Your Vendors. Illustrative example only: a café with two countertop terminals and an online gift card page hosted by its provider would list both channels, confirm with the acquirer which questionnaire covers them, change default passwords on its router, and set a calendar reminder for next year. This is general information, not legal advice (September 17, 2026).

The self-assessment questionnaire, in plain terms

Most small merchants prove compliance each year with a self-assessment questionnaire rather than an outside audit. Which questionnaire you complete depends on how cards reach you. A business that sends all online payments to a hosted payment page and never touches card numbers has a much shorter questionnaire than one that stores card data or runs its own payment form. Standalone terminals connected to your provider, and terminals using validated encryption, also shorten it. Ask your provider which questionnaire applies to your setup and whether they can help you complete it.

The PCI non-compliance fee

Many providers add a monthly or annual fee if your questionnaire is not on file. It is not a fine from the card brands in most cases; it is your provider's charge. Completing the questionnaire usually removes it. If you see a PCI fee and a PCI non-compliance fee on the same statement, ask why.

Habits that cut risk more than paperwork

Never write card numbers on paper or in email, notes or spreadsheets. Use unique logins for staff on POS systems and remove them when people leave. Keep terminals and software updated, and inspect terminals for tampering. For online sales, use a hosted or tokenized checkout so card data never touches your server. These habits both reduce your questionnaire scope and reduce the chance of a breach.

Ask for help with the questionnaire

Many providers offer a portal that walks you through the questionnaire with plain-language questions. Ask for it, and ask which answers depend on your equipment.

When a breach happens anyway

If you suspect card data has been exposed, contact your provider immediately, preserve logs and devices rather than wiping them, and follow the provider's instructions. The card networks may require a forensic investigation, and costs can be significant, which is why reducing the card data you hold is the best protection. Our guide on what to do after a data breach covers the first steps.