PCI DSS applies to every business that accepts card payments, however small. Most small merchants prove compliance with a Self-Assessment Questionnaire (SAQ). If you fully outsource card handling to a compliant provider and store no account data, SAQ A is the shortest form, but it has eligibility conditions you must meet.
Key takeaways
- The standard applies by how you handle card data, not by company size.
- Outsourcing payment pages reduces your scope. It does not remove it.
- SAQ A suits card-not-present merchants that fully outsource account data functions and store no account data electronically.
- Requirements 6.4.3 and 11.6.1 on payment page scripts became mandatory on 31 March 2025.
- Your acquirer or payment processor tells you what validation they require.
Who has to follow PCI DSS?
Anyone that stores, processes or transmits cardholder data, or can affect the security of that data. A shop that uses a hosted payment page still has duties, but fewer. Ask your acquirer or processor which validation they expect, because card brands and acquirers set the reporting rules.
Which SAQ applies to a small merchant?
It depends on how card data reaches your systems. The Council describes SAQ A as the form for card-not-present merchants (e-commerce, mail order or telephone order) that fully outsource account data functions to PCI DSS compliant third parties and store no account data electronically.
| Situation | Typical direction |
|---|---|
| Checkout fully on a provider's hosted page or iframe, no card data on your servers | SAQ A, if eligibility criteria are met |
| Your website affects how the payment page behaves but card data goes to a provider | Another SAQ, possibly with more requirements |
| You store or process card data yourself | A longer SAQ or full assessment |
We did not fetch the Council's SAQ pages for the second and third rows, so treat them as direction only and check the current SAQ instructions and your acquirer.
What changed for e-commerce in 2025?
PCI DSS v4.0.1 made requirements 6.4.3 and 11.6.1 mandatory on 31 March 2025 after years as best practices. They aim to stop e-skimming, where malicious scripts in a customer's browser steal card data. They cover authorizing and checking the integrity of payment page scripts and detecting unauthorized changes to pages.
For SAQ A, the Council removed 6.4.3, 11.6.1 and the supporting risk analysis 12.3.1 from the form. It added an eligibility criterion that merchants confirm their site is not susceptible to scripts that could affect their e-commerce systems. The requirements remain in the full standard.
How can a small merchant meet the script criterion?
Per the Council's FAQ 1588 as summarized in its blog, you can use techniques like those in 6.4.3 and 11.6.1, run by you or a third party. Or you can get confirmation from a compliant provider that supplies the payment iframe, if you implement it as the provider instructs. Scripts that cannot affect account data security are treated differently.
Practical steps:
- List every script on the page that hosts or wraps your payment form.
- Remove ones you do not need.
- Load the remainder from sources you trust, and review changes.
- Keep the provider's integration instructions and your confirmation on file.
You can check JavaScript dependencies for known vulnerabilities with the free scan at gold.safeguard.sh/scan. It runs in the browser and the file stays on your machine.
Frequently asked questions
Do small businesses really need PCI DSS?
Yes, if they accept card payments. Size affects how you validate, not whether the rules apply.
Does using a payment provider make me compliant?
It reduces your scope, but you still have responsibilities and must validate. Confirm which requirements the provider covers.
What is SAQ A?
It is the shortest self-assessment for card-not-present merchants that fully outsource account data functions and store no account data electronically.
Who do I submit my SAQ to?
Your acquirer or payment processor, which sets the reporting process. Ask them directly.
Sources
Last reviewed: 19 October 2026.
