PCI Compliance UK Guide: Who Needs PCI DSS and How to Comply

PCI compliance in the UK means meeting the Payment Card Industry Data Security Standard (PCI DSS), currently version 4.0.1, and proving it to your acquirer every year. It is not a UK law. It is a condition of your merchant agreement, and it applies to every business that takes card payments, from a sole trader with one card reader to a payment processor. Most small merchants validate with a Self-Assessment Questionnaire (SAQ). The largest merchants and service providers need an assessment by a Qualified Security Assessor (QSA).

This guide is written by Sovereign Secure, a PCI SSC-approved QSA company based in Lancashire. It covers who has to comply, how UK acquirers enforce it, merchant levels, which SAQ applies, the v4.0.1 deadlines, costs and fees, and the steps to become compliant.

What is PCI compliance in the UK?

PCI DSS compliance in the UK means meeting a set of 12 security requirements for protecting payment card data, and proving it to your acquirer every year. The standard is written and maintained by the PCI Security Standards Council (PCI SSC), which the major card brands, including Visa and Mastercard, founded in 2006. PCI DSS in the UK is the same standard used in the US, Europe and Asia. What is specific to UK PCI compliance is how acquirers enforce it and how it sits alongside UK data protection law. If you are new to the standard, our guide to what PCI DSS is explains the acronym, the card data it protects and how it is organised.

Being “PCI compliant” has two parts:

• Meeting the requirements all year round for every system that stores, processes or transmits card data, or could affect its security. Together these systems, people and processes form your cardholder data environment (CDE).
• Validating once a year by giving your acquirer an SAQ or a Report on Compliance (ROC), plus a signed Attestation of Compliance (AOC). Quarterly external vulnerability scans are also needed where your SAQ requires them.

The 12 requirements cover network security controls, secure configuration, protecting stored account data, encrypting card data in transit, malware protection, secure systems and software, need-to-know access, user identification and authentication, physical security, logging and monitoring, regular security testing, and security policies. Our PCI compliance checklist turns them into the evidence an assessor will ask for. The standard itself is free from the PCI SSC document library.

Is PCI DSS a legal requirement in the UK?

No. PCI compliance is not required by UK law, because no UK statute requires PCI DSS. The obligation is contractual: the card brands require acquirers to make their merchants comply, and your acquirer writes that into your merchant agreement. Failing to comply is a breach of contract, not an offence.

The law still matters. Card data is personal data, so UK GDPR and the Data Protection Act 2018 apply to it. Article 32 of UK GDPR requires “appropriate technical and organisational measures”, and for card data PCI DSS is the recognised industry benchmark. A card breach can therefore start two separate processes:

Our comparison of PCI DSS vs GDPR sets out where the two overlap and where meeting one does not satisfy the other.

Who needs to be PCI compliant?

Every organisation that accepts, processes, stores or transmits payment card data, or whose systems could affect the security of that data, is required to be PCI compliant. If you take card payments in the UK, you need PCI compliance whatever your size: size changes how you validate, not whether you must comply. In practice that includes:

• Merchants of every size: shops, restaurants, hotels, online retailers and sole traders with a card reader.
• Charities that take card donations online, by phone or at events.
• Public-sector bodies such as councils, NHS trusts and universities that take card payments for services, fees or fines.
• Service providers that handle card data for others or can affect its security: payment gateways and processors, hosting and cloud providers, managed IT and security providers with access to a CDE, outsourced contact centres, and SaaS platforms that take payments for their customers.

Outsourcing reduces your scope; it does not remove it. A website that sends customers to a compliant provider’s hosted payment page still has to complete SAQ A, because the page that sends them there could be tampered with. Get your provider’s AOC and a written split of which requirements it covers for you and which remain yours; our guide to PCI compliant payment gateways lists what to ask for.

Who enforces PCI compliance in the UK?

Your acquirer does. The PCI SSC writes the standard but does not enforce it or fine anyone. Each card brand runs its own compliance programme and holds acquirers responsible for their merchants. Acquirers pass that obligation down to you through the merchant agreement.

PCI with your acquirer: Barclaycard, Lloyds Cardnet and Clover

Most UK acquirers and merchant services providers, including Barclaycard, Lloyds Cardnet, Paymentsense and Clover, manage smaller merchants’ PCI compliance through an online portal, often run by a specialist compliance vendor. The process is broadly the same:

1. You receive portal log-in details when your account opens, or when your compliance status lapses.
2. The portal asks how you take payments and suggests an SAQ.
3. You complete the SAQ, upload ASV scan reports if they are required, and sign the AOC; our guide on how to fill out a PCI SAQ covers the common mistakes.
4. Your status is reported to the acquirer, and any non-compliance fee should stop once you show as compliant.

Two cautions. The portal’s questions decide your SAQ, so a loose answer can put you on the wrong one; check the eligibility criteria in the SAQ yourself. And if a QSA has validated you, send the AOC to your acquirer’s compliance team and ask them to confirm your status has been updated.

What differs between providers is mainly the programme name and the portal. These are independent summaries; check the current details with your provider:

• Barclaycard: merchants validate through Barclaycard’s Data Security Manager programme.
• Lloyds Cardnet: Cardnet merchants validate every year, and your Cardnet account team can tell you how to reach the compliance portal.
• Clover: Clover is a point-of-sale platform from Fiserv, and the provider of your Clover account tells you how and where to validate.
• Worldpay: our guide to Worldpay PCI compliance explains what Worldpay merchants must do.

PCI compliance levels: which level are you?

Your level depends on how many card transactions you process each year with each card brand, and it decides how you validate. The thresholds below are the ones Visa and Mastercard publish: Visa now publishes three merchant levels and Mastercard four. American Express uses different thresholds, and your acquirer confirms your level and can set stricter requirements.

Enterprise customers may still ask a Level 2 service provider for a ROC, because it gives them independent assurance. Our guide to PCI Level 1 covers what the top level involves for merchants and service providers, and our guide to PCI compliance levels explains how each card brand defines them.

SAQ or ROC: how do you prove PCI compliance?

There are two routes. A Self-Assessment Questionnaire (SAQ) is a self-declaration for eligible merchants and smaller service providers; which SAQ you use depends entirely on how you take payments. A Report on Compliance (ROC) is a detailed assessment written by a QSA, required at Level 1 and chosen by many others. Both routes end with an Attestation of Compliance (AOC), the signed summary your acquirer and customers ask for.

There is also SAQ SPoC for merchants using a PCI-listed software-based PIN entry solution on a phone or tablet. If you take payments through several channels, you may need more than one SAQ, or SAQ D; agree this with your acquirer before you start. Our guide to which PCI SAQ you need walks through the eligibility criteria for each one.

Some acquirers want a QSA or ISA involved in the SAQ, and Mastercard requires Level 2 merchants completing SAQ A, A-EP or D to engage a QSA or a PCI SSC-certified ISA. A QSA review before you submit also catches a common and costly mistake: a merchant on the wrong SAQ. If you need an assessor, our guide on how to choose a PCI QSA explains how to verify and compare firms.

What changed in PCI DSS v4.0.1?

PCI DSS v4.0.1 is the only version in force. It replaced v4.0 at the end of 2024, and every future-dated requirement became mandatory on 31 March 2025, so any SAQ or ROC completed now covers them in full.

The v4.0.1 requirements UK businesses most often have to work on:

• 6.4.3 and 11.6.1: authorise, justify and check the integrity of every script on your payment page, and detect unauthorised changes to it at least weekly. These target card-skimming code on e-commerce sites. SAQ A merchants must instead confirm their site is not susceptible to script attacks.
• 8.4.2: multi-factor authentication for all non-console access into the CDE, not just remote access.
• 12.3.1: a documented targeted risk analysis wherever you choose how often a control runs.
• 5.4.1: automated protection against phishing.
• 10.4.1.1: automated reviews of audit logs.
• 12.5.2: confirm and document your PCI DSS scope at least every 12 months, or every 6 months for service providers (12.5.2.1).

How much does PCI compliance cost in the UK?

Anything from a few hundred pounds to tens of thousands. A published UK cost guide we reviewed in September 2026 put the range at around £500 at the low end to over £75,000 for large, complex programmes. Where you sit depends far more on your scope and validation route than on your turnover.

Remediation work (MFA, central logging, payment-page script monitoring) and staff time are real costs that do not appear on an assessor’s quote. Our PCI compliance cost guide shows how each driver changes the price.

What if you miss your annual validation?

Most UK acquirers add a monthly charge until they accept a valid SAQ or AOC, and a card data breach costs far more, from a forensic investigation to card-brand costs passed on under your merchant agreement and possible ICO action under UK GDPR. Our guide to the PCI non-compliance fee explains why the charge appears, how fines differ from fees and what makes the fee stop.

How to become PCI compliant in the UK: 8 steps

Here is how to become PCI compliant in the UK, step by step. The steps are the same whether you are working out how to be PCI DSS compliant for the first time or getting PCI compliance back after it has lapsed. Before step 1, our free PCI compliance check suggests your likely SAQ and gives you a prioritised fix list in about five minutes. To turn the steps into a dated plan with owners, use our PCI DSS compliance roadmap template.

1. Confirm your level and validation route with your acquirer, in writing.
2. Map how card data moves through your business (every channel, system, person and third party) to define your CDE.
3. Reduce scope before you secure it. Hosted payment pages, P2PE terminals, tokenisation and telephone payment masking can take whole systems out of scope.
4. Choose your SAQ, or confirm you need a ROC, using the eligibility criteria rather than a best guess.
5. Run a gap analysis against PCI DSS v4.0.1. If you lack in-house expertise, PCI DSS consultancy covers the gap analysis and remediation plan.
6. Close the gaps: policies, targeted risk analyses, MFA, logging, patching, script management and third-party agreements.
7. Test: quarterly external ASV scans by a PCI SSC Approved Scanning Vendor, quarterly internal scans and, where your SAQ or ROC requires it, annual PCI DSS penetration testing and segmentation testing.
8. Validate and keep it running: submit the SAQ or ROC with the AOC, then treat compliance as a year-round routine rather than an annual form.

Can I do PCI compliance myself?

Yes, most merchants can. If you are eligible to self-assess, you complete the SAQ yourself and sign your own AOC, and no assessor has to be involved unless your acquirer or a card brand rule requires one (Mastercard, for example, requires Level 2 merchants on SAQ A, A-EP or D to engage a QSA or ISA). Two parts cannot be done in-house:

• A Report on Compliance. Level 1 merchants and Level 1 service providers validate with a ROC, written by a QSA (or, for merchants, an ISA where the card brand allows it).
• External vulnerability scans. Where your SAQ or ROC requires quarterly external scans, they must be run by a PCI SSC Approved Scanning Vendor (ASV). We deliver them through our PCI SSC Approved Scanning Vendor partner.

Outside help is worth paying for when you are not sure which SAQ applies, when you take payments through several channels, when your website or systems receive card data and you face SAQ D, when a scan keeps failing or a non-compliance fee will not stop, or when customers ask you, as a service provider, for independent assurance. In those cases, PCI DSS consultancy can confirm your route and plan the fixes before you submit anything.

PCI compliance by sector

If your team keys card details from calls, our guide to taking card payments over the phone covers virtual terminals, payment links and what must never be written down.

How to choose a QSA in the UK

Start by checking the company appears on the PCI SSC’s list of Qualified Security Assessors and that its listing covers the UK. Then ask:

• Has it assessed businesses like yours, in your sector and with your payment channels?
• Who will do the assessment, and are they individually qualified as QSAs?
• How does it keep consulting and assessing separate? PCI SSC’s rules for QSAs include independence requirements.
• Can it cover penetration testing, segmentation testing and ASV scans (through a listed ASV), or will you manage several suppliers?
• Is the price fixed for an agreed scope, and what happens if the scope changes?

When you need a Level 1 ROC or a QSA-signed SAQ, our PCI compliance audit service covers it, and our PCI QSA page explains what a QSA does and how to verify one.

Why Sovereign Secure

Sovereign Secure Ltd has been a UK company since 2012 (Companies House 08334453), headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. The PCI Security Standards Council has approved us as a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA), a Card Production Security Assessor (CPSA), a P2PE Assessor and a 3DS Assessor, and we are a member of its Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.

We are ISO 27001 certified and ICO registered. We carry out penetration and segmentation testing, and deliver quarterly external scans through our PCI SSC Approved Scanning Vendor partner. Clients shown on our site include Fiserv, Accor, Ticketmaster, Cashplus and Nitecrest. See the full range of our PCI DSS compliance services.

PCI compliance UK glossary

Get your PCI compliance route confirmed

Not sure which SAQ applies, what level you are, or whether you need a QSA? Tell us how you take card payments and we will confirm your validation route and send a fixed quote. Contact our PCI team or call +44 161 523 5276.