Guide
PCI compliance basics for small businesses
Updated 9 September 2026 · 6 min read
PCI DSS is the card industry's security standard for anyone who handles card data. If you use a hosted checkout page where the customer enters card details on the processor's domain, your obligations reduce to the shortest self-assessment questionnaire — typically SAQ A — plus keeping your site and vendors in order.
What PCI DSS actually is
PCI DSS is a contractual standard imposed by the card networks, not a law. Non-compliance is enforced through your processor's agreement and, after a breach, through fines and liability.
Your validation level depends on annual transaction volume and how card data flows through your systems.
Scope is the whole game
Everything that stores, processes or transmits card data is in scope. The goal is to have as little of that as possible.
Hosted checkout and hosted payment fields keep card data entirely with the processor. Your servers only ever see tokens and payment identifiers, which are not card data.
What you still have to do
Serve your entire site over HTTPS with a valid certificate.
Keep your platform, plugins and dependencies patched — a compromised script on a checkout page can skim card details even when the fields are hosted elsewhere.
Use unique accounts with multi-factor authentication for anything that can view payment data.
Complete the annual self-assessment questionnaire your processor asks for, and keep vendors' compliance attestations on file.
Things that quietly break compliance
Taking a card number over the phone and writing it on paper or into a support ticket.
Emailing card details, or accepting them by email from a customer.
Storing full card numbers in your own database for convenience. Use the processor's saved-payment-method feature instead.
Frequently asked
- Does hosted checkout make me fully PCI compliant automatically?
- It removes most of the burden but not all of it. You still complete the simplest self-assessment questionnaire and maintain basic security hygiene on your own site.
- Can I store card numbers if I encrypt them?
- You can in principle, but doing so moves you into a far heavier compliance category. Use tokenised saved payment methods instead.
- How often do I need to revalidate?
- Annually for most small businesses, plus quarterly external scans if your validation type requires them.