Small UK businesses that accept card payments need to meet the PCI DSS requirements applicable to their payment setup. For many merchants, this means confirming how payments are handled, completing the appropriate Self-Assessment Questionnaire, protecting payment equipment and carrying out any required security checks. Your acquiring bank or payment provider should confirm your validation obligations.
The good news is that you don’t need to become a cybersecurity expert to get started. You do need to understand where your responsibilities begin and what your payment provider handles.
Whether you run a convenience shop, café, takeaway or mobile phone shop, this guide explains PCI compliance for small businesses in the UK in practical terms.
Key takeaways
| Topic | What your business needs to know |
|---|---|
| Small business status | A low number of card transactions doesn’t automatically remove your responsibilities. |
| Outsourced payments | Using a payment provider can reduce your scope, but you still have merchant obligations. |
| Questionnaires | Choose the SAQ that matches your actual payment environment. |
| Card data security | Avoid collecting or keeping card details unnecessarily. |
| Payment terminals | Check equipment for tampering and control who can access it. |
| Ongoing compliance | Keep security practices active between assessments. |
These principles follow the PCI Security Standards Council’s merchant guidance and its explanation of outsourced payment responsibilities.
What is PCI DSS?
PCI DSS means Payment Card Industry Data Security Standard. It sets security requirements for protecting payment account data, including the systems and processes that handle it.
For a small merchant, that can involve your card terminal, payment software, relevant network connections, staff procedures and relationships with payment providers. The exact scope depends on how your business accepts payments.
So, what actually happens when a customer taps their card?
The payment equipment and provider handle the transaction. Your role includes using that equipment correctly, protecting it from interference and understanding whether any of your own systems receive card data.
The current standard is PCI DSS v4.0.1. Requirements previously scheduled for 31 March 2025 are now effective, so older checklists may no longer reflect what your business needs to assess.
Does PCI compliance apply to small UK merchants?
Yes. PCI DSS applies regardless of business size where payment account data is stored, processed or transmitted, including through outsourced arrangements.
A small café using one terminal may have a simpler assessment than a retailer with several shops and an online checkout. Simpler doesn’t mean exempt.
Your acquirer—the financial institution that supports your merchant card acceptance—or payment provider should explain what evidence you must submit and when. Payment brands manage their own compliance programmes, so don’t assume another shop’s requirements apply to yours.
Does your payment provider handle everything?
Outsourcing can reduce the number of requirements that apply directly to your systems. However, you remain responsible for checking the provider’s compliance for the services used, understanding shared responsibilities and monitoring its status at least annually.
Written agreements should also acknowledge the provider’s relevant responsibilities. Ask for suitable compliance evidence covering your service rather than relying on a general “secure payments” statement. pcisecuritystandards.org
Which PCI questionnaire do you need?
A Self-Assessment Questionnaire, or SAQ, helps eligible businesses assess and report their compliance. It isn’t simply a registration form: your answers should reflect the controls actually in place.
Different SAQs cover different payment environments. These examples are starting points, not automatic assignments:
| Payment arrangement | SAQ that may be relevant |
|---|---|
| Eligible standalone, approved IP-connected terminals | SAQ B-IP |
| Eligible manual entry into a provider-hosted virtual terminal | SAQ C-VT |
| Eligible outsourced card-not-present payments | SAQ A |
| Eligible use of a PCI-listed point-to-point encryption solution | SAQ P2PE |
Each questionnaire has detailed eligibility conditions. Confirm the correct route with your acquirer before completing it, especially if you combine in-store, telephone and online payments.
For example, a takeaway might use a counter terminal and also enter telephone orders on an office computer. Describing the business as “terminal only” would miss part of its payment setup.
Six practical steps towards compliance
1. Map every way you accept payments
Start with a simple list: counter payments, portable terminals, telephone orders, website checkout and payment links.
For each method, record the equipment, provider and staff involved. Check whether card details ever appear in notebooks, emails, spreadsheets, call recordings or support logs.
This gives your provider a clearer picture when confirming scope. It can also reveal workarounds that nobody intended to become routine.
2. Avoid keeping unnecessary card details
A restaurant booking doesn’t need to become a spreadsheet containing customers’ full card numbers. Where appropriate, use your provider’s supported payment or deposit process instead.
Never retain a card’s CVV or CVC security code after payment authorisation, even in encrypted form. Customer permission doesn’t make storing it acceptable.
If you take telephone payments, check how call recording is handled. Ask your provider how to prevent card details being captured in recordings or staff notes.
3. Inspect and protect payment terminals
Keep a record of your devices, including their locations and identifying details. Train staff to recognise unexpected attachments, altered cables or a terminal that has been replaced without authorisation.
For a grocery shop, a sensible opening routine could include checking the reader before serving customers. Set the inspection frequency according to your applicable requirements and risk assessment.
Verify anyone claiming to service or replace equipment through a trusted contact. The PCI Council identifies terminal skimming and tampering as payment security risks.
4. Secure accounts, software and support access
Replace default passwords and give staff appropriate access for their roles. Remove access when people leave.
Keep relevant systems updated and control remote support connections. Use multi-factor authentication—an additional identity check alongside a password—where required, particularly for remote access into the payment environment.
A shop manager should know who can connect remotely, why they need access and how that access is disabled. These practices address risks highlighted in the Council’s payment security guidance.
5. Complete validation and required testing
Confirm the current SAQ, supporting documents and submission deadline with your provider. An Attestation of Compliance, or AOC, is the formal statement accompanying the relevant assessment.
Ask whether external vulnerability scans are required. Where applicable, these use an Approved Scanning Vendor, or ASV, to check relevant internet-facing systems for weaknesses. Don’t assume every small merchant has identical scanning obligations. listings.pcisecuritystandards.org
If a requirement isn’t met, arrange the necessary changes before declaring compliance. Keep copies of submitted documents and evidence.
6. Make security part of everyday work
Give one person responsibility for compliance reminders and provider correspondence. Keep a short staff procedure covering equipment checks, suspicious requests and incident reporting.
Review your scope whenever you introduce a website checkout, change terminals or add a payment method. A previous assessment may not describe the new arrangement.
EPOS systems, payment links and online payments
Integrated EPOS payments
With integrated payments, your EPOS can send the sale amount to a compatible terminal and receive the transaction result. Ask your supplier exactly what data passes between the systems.
Don’t assume integration proves that the whole business is compliant. A PCI-listed point-to-point encryption, or P2PE, solution can reduce applicable requirements, but it must be a validated solution used according to its instructions. Ordinary encryption claims aren’t enough to establish SAQ P2PE eligibility.
When exploring Switch & Save EPOS systems, discuss payment compatibility and responsibility alongside stock management, reporting and checkout features.
Payment links and website checkout
A provider-hosted payment link can help you collect payment without asking customers to send card details directly to your business. Confirm your remaining obligations with the provider.
Website checkout needs particular care. Redirecting customers to a provider and embedding a payment form on your own site are different arrangements.
For relevant embedded forms, current SAQ A eligibility includes confirming protection against script attacks that could affect the e-commerce system. Ask your provider and website developer how your implementation meets the applicable conditions.
PCI compliance costs and common mistakes
There isn’t one fixed PCI compliance price for every UK merchant. Ask for an itemised explanation of assessment support, scanning, technical work and any contractual non-compliance charges.
When comparing card machine options, look beyond the transaction rate. Check what compliance support includes, what you must do yourself and whether additional services are chargeable.
Avoid these common mistakes:
- Assuming a new terminal makes the entire business compliant.
- Selecting a shorter questionnaire without meeting its eligibility conditions.
- Paying a compliance fee and assuming no further action is needed.
- Forgetting to reassess after adding telephone or online payments.
Also be cautious about generic “PCI certificates”. The Council advises using official PCI assessment documentation rather than accepting alternative certificates as proof of compliance.
What to do if you suspect a security problem
If a terminal looks altered or a payment system behaves unexpectedly, stop using the affected equipment and contact your payment provider promptly through a trusted number.
Record what staff noticed and when. Avoid resetting, deleting or altering the affected system before receiving instructions, because evidence may be needed.
Keep incident contact details somewhere staff can reach during a busy shift. A clear response procedure is more useful than trying to improvise at the counter.
Make your next payment decision with clearer information
Start by asking your provider three things: which SAQ applies, what testing is required and which responsibilities remain with your business.
Switch & Save helps UK businesses reduce costs with AI-powered EPOS systems, card payment solutions and business finance. If you’re reviewing your checkout setup, bring your current payment arrangements and provider charges to the conversation.
Check your savings today with Switch & Save.
FAQs
Do I need PCI compliance if I only take contactless payments?
Yes. Contactless acceptance doesn’t automatically exempt your business. Confirm the applicable requirements and validation route with your acquirer. pcisecuritystandards.org
Do I need to validate if I never store card details?
Not storing card details can reduce scope, but it doesn’t automatically remove validation obligations. Outsourced merchants still have responsibilities. pcisecuritystandards.org
How often should I complete my PCI assessment?
Follow your acquirer’s compliance programme and deadlines. Keep security controls operating between assessments and review changes to your payment setup. pcisecuritystandards.org
Can I store a customer’s CVV for their next purchase?
No. CVV and CVC codes must not be stored after authorisation, including for repeat purchases or with customer consent. pcisecuritystandards.org
Does buying a secure card machine prove compliance?
No. Your assessment also depends on how equipment is installed, used and managed, plus your applicable processes and systems. pcisecuritystandards.org
