PCI DSS turns up in the small print of most card reader agreements. Providers mention it in their terms. Some charge a fee for it. Very few explain what it actually means for a small business owner who just wants to take card payments safely.
This guide covers what PCI DSS is, what it requires from you as a small business, how much of it your card reader provider handles automatically, and what you might actually need to do yourself.
What is PCI DSS ?
PCI DSS stands for Payment Card Industry Data Security Standard. It’s a set of security requirements created and maintained by the major card networks (Visa, Mastercard, American Express, Discover) to protect card payment data from fraud and theft.
Every business that accepts, stores, processes, or transmits card data must be PCI DSS compliant. That includes the smallest sole trader taking occasional contactless payments.
PCI DSS is not a UK law or government regulation. It’s a contractual requirement imposed by card networks on anyone who accepts their cards. Fail to comply, and your payment processor can fine you or terminate your account. More importantly, if a data breach occurs and you’re found non-compliant, you can face substantial fines and liability from the card networks.
PCI DSS v4.0.1 is the current version, mandatory from March 2025.
Why most small businesses barely need to think about it
The reason most small business guides skip past PCI DSS is that app-based card readers from Square, SumUp, Zettle, and Barclaycard handle the vast majority of compliance requirements on your behalf.
These providers are themselves PCI DSS certified. Their card readers encrypt card data at the point of tap or insertion — the data never sits in a readable state on your phone. The processing happens on their certified infrastructure. Their apps don’t let your device store full card numbers.
In practice, using a certified card reader from a certified provider means your compliance risk is very low and most of the technical requirements are met for you.
What you still need to do
Using a compliant provider reduces your scope — but doesn’t remove it entirely.
For small businesses using app-based card readers (the majority of this site’s readers), you’re typically classified as a PCI DSS Level 4 merchant: the lowest level, covering merchants that process fewer than one million card transactions per year. Most UK small businesses fall here.
At Level 4, your compliance obligation is:
Annual Self-Assessment Questionnaire (SAQ). A questionnaire you complete yourself to confirm your payment environment meets PCI DSS requirements. For businesses using only a certified card reader with a fully hosted payment page or in-person reader, this is typically SAQ B or SAQ B-IP — short questionnaires focused on your physical device and how it’s used, not your technical infrastructure.
If you also take payments through an online checkout on your own website (not just hosted by your payment provider), the SAQ may be longer — SAQ A if the payment page is fully hosted by the provider, or SAQ A-EP if your website scripts touch the checkout at all.
Your provider usually manages this for you. Square, SumUp, Zettle, and Barclaycard all include PCI compliance support. Some providers handle the SAQ submission on your behalf. Others prompt you annually to complete it through their portal. Log into your account dashboard and look for a compliance or security section — this is usually where it’s managed.
The PCI compliance fee
Some providers charge a monthly or annual PCI compliance fee — typically £2–5/month or £25–60/year. This fee covers the cost of the compliance programme your provider runs, including the SAQ process, security monitoring, and sometimes breach insurance.
Worldpay and some contracted terminal providers are more likely to charge this explicitly. Square and SumUp generally include compliance support within their standard service, though it’s worth checking your specific plan.
If you see a PCI non-compliance fee on your statement, it usually means you haven’t completed the annual SAQ. Log in and complete it — the fee typically disappears once the questionnaire is done.
What if you take card payments online?
Taking payments online through a hosted payment page (where your customer is redirected to the provider’s checkout and you never see card details) puts you in the simplest compliance category: SAQ A. The provider handles everything; you confirm annually that you’re using their hosted checkout correctly.
If your website has any custom checkout code that touches payment fields — embedded forms, scripts that run on the payment page, custom integrations — you may fall into SAQ A-EP or higher, which carries more requirements. Under PCI DSS v4.0.1, e-commerce security has received increased scrutiny, with new requirements around protecting payment pages from malicious script injection.
If you’re running a Shopify, Wix, or Squarespace store and using their built-in payment processing, you’re almost certainly in SAQ A territory and your compliance is largely handled.
If you’ve built a custom checkout, speak to your payment provider or a PCI specialist to confirm your SAQ type before completing it incorrectly.
Phone and manual card payments
Keying in card details over the phone (virtual terminal or manual entry) introduces more complexity, because card data passes through your systems more directly. Most virtual terminal providers handle the technical requirements, but you may have a slightly longer SAQ to complete.
If you take telephone payments regularly and haven’t confirmed your SAQ type with your provider, it’s worth a quick check.
What happens if there’s a data breach?
If card data associated with your business is compromised and you’re found non-compliant with PCI DSS at the time of the breach, the consequences can include:
- Fines from the card networks (typically £5,000–£100,000 depending on severity and volume)
- Liability for fraudulent transactions traced to the breach
- Mandatory forensic investigation costs
- Account termination
If you’re compliant, you’re not immune from breach but your liability is significantly reduced and you’re protected from the worst penalties.
For small businesses using certified card readers and reputable providers, the practical risk of a breach is very low. The reader encrypts card data before it leaves the device. There’s nothing on your phone to steal.
A quick practical checklist
For most small businesses using Square, SumUp, Zettle, or Barclaycard Smartpay Anywhere:
- You’re using a PCI-certified card reader: your provider handles the hardware security
- Complete the annual SAQ when prompted by your provider (usually takes 15–30 minutes)
- Check your account statement for unexplained PCI fees — if you see one, complete the SAQ to remove it
- If you take online payments, confirm with your provider whether you’re SAQ A or SAQ A-EP
- Don’t store written card numbers, CVV codes, or PINs anywhere — ever
That’s most of what PCI DSS requires of a typical small business using modern payment tools. The more involved requirements (network scans, penetration testing, full security assessments) only apply at transaction volumes most small businesses won’t reach.
See our how card readers work guide for more on how payment security works in practice, or our guide to choosing a card reader if you’re still deciding on a provider.
GoSmallBusiness is reader-supported. We may earn a commission if you sign up through links in this article, at no extra cost to you.
