TL;DR:

  • PCI DSS (Payment Card Industry Data Security Standard) applies to any business that accepts card payments — but the compliance burden varies enormously based on how your payment processing works
  • Most small businesses using hosted payment pages (Stripe Checkout, PayPal, SumUp) qualify for SAQ A — a self-assessment questionnaire with around 20 requirements, most of which you almost certainly already meet
  • Non-compliance doesn’t trigger automatic fines, but it exposes you to significant costs if a breach occurs — card scheme fines from your acquirer, ICO investigation, and potential liability for fraudulent transactions

If you accept card payments as a small business, you’re in scope for PCI DSS whether you’ve heard of it or not. The standard is maintained by the PCI Security Standards Council, a body set up by Visa, Mastercard, American Express, Discover, and JCB. Your acquiring bank (the one that processes your card payments) is responsible for ensuring you comply — though most small business acquirers don’t enforce this very actively unless a breach occurs.

The good news is that for most small businesses, the practical compliance requirement is considerably less than the PCI DSS documentation makes it sound.

Which SAQ Applies to You?

The Self-Assessment Questionnaire (SAQ) is the compliance path for most small and medium businesses that don’t need a formal QSA audit. Which SAQ you need depends on how you handle card data:

SAQ A — The simplest, covering around 20 requirements. Applies if:

  • You accept card payments only via a fully hosted payment page (Stripe Checkout, PayPal, Shopify Payments, Square hosted checkout)
  • Your website redirects customers to the payment provider’s hosted page, OR you use an iframe hosted entirely by the payment provider
  • You never see, store, or transmit cardholder data yourself — it goes directly from the customer to the payment provider’s servers

This covers the vast majority of UK e-commerce businesses using standard Stripe or PayPal integrations. If your checkout page redirects to checkout.stripe.com or displays a Stripe-hosted iframe, SAQ A is almost certainly your path.

SAQ B — For businesses using standalone physical card terminals (like a chip-and-pin terminal from your acquirer or a card reader like Square, SumUp, or iZettle) that are not connected to any other systems. The terminals dial out independently. Common for sole traders and market stall sellers.

SAQ A-EP — Trickier. Applies if you have an e-commerce site where the payment page is on your domain and uses a JavaScript integration (like Stripe Elements or Stripe.js) rather than a full redirect. Your page never touches the card data, but because you control the page that loads the payment script, the PCI scope is slightly wider.

SAQ C-VT — For businesses using a virtual terminal (a web browser interface where you key in card numbers, usually for phone orders). More requirements than A or B.

SAQ D — The most complex, covering all other scenarios including storing card data, processing via custom integrations, or operating your own payment infrastructure. Most small businesses never need this.

What SAQ A Actually Requires

The SAQ A checklist is surprisingly manageable. The requirements you need to verify include things like:

  • Your payment provider is PCI DSS compliant (they are — Stripe, PayPal, Square, SumUp all maintain their own compliance certificates)
  • You don’t store any cardholder data in your own systems
  • Your website uses HTTPS (free via Let’s Encrypt if you’re on a modern host)
  • Your payment provider integration follows their documentation (no custom modifications that intercept card data)
  • You have a clear written security policy (a one-page document is sufficient)
  • Default passwords on any networked equipment have been changed

Most SAQ A businesses can complete the self-assessment honestly in about 30–60 minutes by confirming they’re following standard practice. You submit the SAQ to your acquirer (often through a portal they provide) annually.

What Happens If Something Goes Wrong

PCI DSS compliance doesn’t have a UK government regulator behind it — the enforcement comes from the card schemes (Visa, Mastercard) and flows through your acquirer.

If you have a breach and you weren’t PCI DSS compliant, your acquirer can be held liable by the card schemes for fraudulent transactions, and they’ll typically pass those costs on to you. Fines can range from thousands to tens of thousands of pounds depending on the scale of the breach and how long non-compliance had persisted. Your acquirer can also terminate your card acceptance agreement.

The ICO (Information Commissioner’s Office) gets involved if personal data was breached — card data always includes personal data, so a card breach is a GDPR breach. Under GDPR you have 72 hours to report a breach to the ICO. Fines from the ICO for smaller businesses are usually in the lower range, but investigations are time-consuming and publicly visible.

Action Fraud is the reporting route for fraud that resulted from a breach, but they’re not the regulatory body — reporting there doesn’t affect your PCI or ICO obligations.

Practical Steps for a Small Business

1. Work out which SAQ applies. If you use Stripe Checkout, PayPal’s hosted checkout, or Shopify Payments with the default integration, it’s almost certainly SAQ A.

2. Complete the SAQ honestly. Your acquirer provides access to a compliance portal — log in, complete the SAQ A questionnaire. Be accurate rather than aspirational.

3. Run a quarterly network scan if required. SAQ A doesn’t require an external vulnerability scan for most scenarios, but SAQ A-EP does. Check your specific SAQ requirements.

4. Check your payment provider’s integration documentation. If you integrated Stripe Elements yourself, make sure you followed the security recommendations — using the latest version of Stripe.js, not logging card data server-side, having CSP headers set correctly.

5. Have a brief written security policy. This can be a single-page document covering how card data is handled (it isn’t — your provider handles it), who has access to the payment portal, and what you’d do in the event of a suspected breach.

The compliance overhead for a typical small e-commerce business using a hosted checkout is genuinely low. The bigger risk to most small businesses isn’t the PCI compliance process — it’s having an outdated CMS or plugin that gets compromised before the card data even reaches the payment form.