PCI Compliance for Small Businesses: What You Need to Do

Every small business that accepts card payments must comply with PCI DSS, whatever its size. In practice, most small businesses are Level 3 or Level 4 merchants, depending on the card brand, and validate once a year with a Self-Assessment Questionnaire (SAQ) and an Attestation of Compliance for their acquirer, plus quarterly vulnerability scans if they have internet-facing payment systems. The less card data touches your systems, the less work it is.

This guide explains what PCI compliance for a small business involves, what being a PCI Level 4 merchant means, which SAQ you are likely to need, and how to keep the effort small.

Key takeaways

• PCI DSS applies to every business that takes card payments, with no exemption for size.
• Most small businesses are PCI Level 4 merchants under Mastercard’s thresholds (Level 3 under Visa’s), and their acquirer decides how they validate.
• Most small businesses self-assess with an SAQ once a year; the right SAQ depends on how you take payments.
• The “PCI fee” on a merchant statement is not certification and does not make you compliant.
• Outsourcing card handling to validated providers can cut your requirements dramatically.

Do small businesses need to be PCI compliant?

Yes. PCI DSS applies to any organisation that stores, processes or transmits cardholder data; our guide to what PCI compliance means explains the standard itself. In the UK it is a contractual obligation, set by the card brands and enforced by your acquirer, rather than a law. You agree to it when you sign up to take card payments. Card data is also personal data, so UK GDPR security duties apply alongside it. Our guide to PCI compliance in the UK covers the legal and acquirer side in more detail.

What PCI level is a small business?

Most small businesses are PCI Level 4 merchants with Mastercard, or Level 3 if they have larger online sales, and Level 3 with Visa. Merchant levels are set by the card brands, largely by annual transaction volume. Under Mastercard’s definitions, Level 3 covers more than 20,000 up to 1 million e-commerce transactions and Level 4 covers all other merchants. Visa now publishes only three levels, with Level 3 covering fewer than 1 million Visa e-commerce transactions. Your acquirer confirms your level and how you must validate. Our guide to PCI compliance levels explains every merchant level.

What is a PCI Level 4 merchant?

A PCI Level 4 merchant processes 20,000 or fewer e-commerce transactions a year with a card brand, and no more than one million transactions in total with that brand across all channels. These are Mastercard’s thresholds. Visa no longer publishes a Level 4 and places these merchants in its Level 3. Three details decide where you sit:

• Each brand is counted separately. Your Visa and Mastercard volumes are compared with the thresholds one brand at a time.
• Debit and prepaid cards count towards your level, just as credit cards do.
• Phone and mail-order payments count towards the one million total but not the e-commerce band, so a business that takes most payments by phone can stay at Level 4 with higher overall volumes.

What does a Level 4 merchant have to do each year?

Being Level 4 changes how you prove compliance, not which requirements apply. Every PCI DSS requirement that fits the way you take payments still applies, and your SAQ type decides which ones those are.

• Your acquirer sets the validation. Most UK acquirers ask Level 4 merchants to complete an SAQ and Attestation of Compliance each year, often through an online portal; our guide to Worldpay PCI compliance walks through one example.
• Quarterly ASV scans apply only where your SAQ requires them, typically when internet-facing systems are in scope.
• Payment platforms set their own process. If you take payments through Stripe, Square, SumUp or a similar platform, it tells you what, if anything, to validate.
• A QSA is not normally required, but an acquirer can ask for one, and a card brand can move a merchant to a higher level after a data compromise.

Which SAQ does a small business need?

Every SAQ is free to download from the PCI SSC document library. If you take payments in more than one way, you may need more than one SAQ or a single SAQ D. If you take payments by phone, our guide to taking card payments over the phone shows which SAQ each phone method leads to. Our guide to which PCI SAQ you need walks through the eligibility criteria.

What does PCI compliance for small business involve, step by step?

1. List every way you take card payments, including the occasional phone payment taken by the accounts team.
2. Find and remove stored card data. Check email, spreadsheets, paper forms and call recordings. Delete what you do not need.
3. Simplify where you can, for example by moving to a hosted payment page or a P2PE terminal (see below).
4. Confirm your SAQ type once your set-up is settled, and ask your acquirer how it wants you to validate.
5. Close the gaps the SAQ reveals: patching, strong passwords, MFA, terminal checks, a basic incident plan.
6. Run quarterly scans if your SAQ requires them. External scans must be passing ASV scans from a PCI SSC Approved Scanning Vendor. Our guide on how to pass a PCI ASV scan covers the usual failures and fixes.
7. Complete and submit the SAQ and Attestation of Compliance, then keep the controls running until next year.

Our PCI compliance checklist sets out the requirements behind each step, and our free PCI compliance check shows where you stand in about five minutes.

What is the PCI fee on my merchant statement?

It is usually an acquirer’s PCI programme fee, explained in our guide to PCI compliance cost, or a monthly PCI non-compliance fee charged until your acquirer accepts your annual validation. Neither fee makes you compliant or improves your security.

How much does PCI compliance cost a small business?

It depends mostly on scope: how many systems, people and processes touch card data. For a small merchant using a hosted payment page, the main costs are staff time and perhaps quarterly scans. For a business with several channels, a network that touches card data and staff taking card details by phone, add remediation and possibly professional help. Our guide to PCI compliance cost breaks down the drivers and what changes the total.

How can a small business reduce its PCI scope?

The cheapest way to comply is to have fewer things to secure.

• Outsource online payments. A compliant provider’s hosted payment page or iframe keeps card data off your web server and may qualify you for SAQ A. Since January 2025 you must also confirm your site is not susceptible to script attacks, so website security still matters.
• Use validated P2PE terminals. A PCI-listed point-to-point encryption solution encrypts card data in the terminal and may qualify you for SAQ P2PE. Our guide to P2PE explains how to check a solution is listed.
• Stop storing card numbers. Use your provider’s tokens for repeat payments and refunds.
• Take phone payments out of scope with keypad entry (DTMF masking) or payment links, so staff never hear or see card details.
• Separate payment systems from the office network so only a small environment is in scope. Our PCI DSS scoping guide explains how.

Do I need a QSA or a consultant?

Not usually. Most small businesses complete their own SAQ, and a Qualified Security Assessor is only mandatory if your acquirer requires one. The most cost-effective use of outside help is a short scoping review to confirm your SAQ type and check your evidence, because scoping mistakes are the expensive ones. Our PCI DSS consultancy offers exactly that, from a PCI SSC-approved QSA company.

What happens if a small business is not compliant?

• Non-compliance fees from your acquirer until it accepts your validation.
• Breach costs, including a forensic investigation, card brand charges passed on by your acquirer and emergency remediation.
• Regulatory exposure. A card data breach is usually a personal data breach too. You may need to notify the ICO, and UK GDPR fines can reach £17.5 million or 4% of global annual turnover, whichever is higher.
• Losing card acceptance. In serious cases, an acquirer can end the relationship.

Should a small business get Cyber Essentials too?

It is worth considering. Cyber Essentials does not replace any PCI DSS requirement, but its five controls (firewalls, secure configuration, security update management, user access control and malware protection) overlap with PCI DSS, and certification is recognised by UK customers and required for some government contracts. Cyber Essentials certification from Sovereign Secure starts from £320 + VAT.

How Sovereign Secure can help

Sovereign Secure is a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body. We help small businesses confirm scope and SAQ type, fix the gaps and, where an acquirer requires it, carry out a formal PCI compliance audit. If you are not sure where to start, take the free PCI compliance check first: it suggests your likely SAQ and the gaps to fix before you sign your attestation.