What it means
Start by mapping where cardholder data enters, travels and is stored, including payment pages, terminals, call centres and service providers, because a simple inventory can expose an old process that still receives card numbers. PCI DSS applies to entities that store, process or transmit cardholder data or could affect the security of that environment, and it addresses security controls such as access management, protection of data, secure systems, testing and organisational policies.
The right controls depend on the actual environment and the current standard; PCI DSS version 4.0.1 was published in June 2024, so check the Council's document library before treating any version as current. A hosted checkout may keep card data out of the merchant's own systems and reduce applicable requirements, but it is not a free pass: the merchant must understand the provider's responsibilities, maintain written agreements and validate its own compliance.
Confirm the proper questionnaire or assessment route with the acquirer or payment brand. Do not choose a self-assessment questionnaire merely because it looks shorter, since eligibility depends on how payments work, not business size alone.
A website that can affect a payment page may still need attention even if the card fields are hosted elsewhere. For a small business, make one person accountable for the payment-data map and supplier review, recording which provider handles the card data, where staff might receive it by accident and who can change checkout settings.
Train staff to redirect customers away from sending card numbers through ordinary email or chat. Keep evidence of the controls actually performed, not just a checked form; examples may include access reviews, update records, provider attestations and test results appropriate to the environment.
If a control fails, document the issue, owner and correction date rather than assuming that an annual assessment covers the intervening months. After a change in checkout, website code, terminal or provider, reassess the data flow and applicable validation.
A token can stand in for card data in an application, but its exact security role depends on the design, so ask the provider what remains your responsibility instead of describing every token-based setup as out of scope. Non-compliance can have contractual and operational consequences, which vary by card brand, acquirer, provider and incident.
Neither a questionnaire nor a provider logo guarantees that a breach will not occur, so treat PCI work as an ongoing control process tied to the real payment flow.
In practice
Real-world examples.
Example
An online shop uses a hosted payment page, so it never stores card numbers and completes a short self-assessment.
Example
A restaurant chain's payment provider asks it to confirm PCI compliance each year.
Example
A retailer is fined after a breach reveals it had stored full card numbers in an unencrypted spreadsheet.
Formula
Calculation
PCI compliance is not a numeric score or a cost-benefit formula. Track an internal completion measure without calling it certification:
Control evidence completion = Applicable controls with current evidence / Applicable controls selected for review x 100
In a fictional review of 20 applicable controls, evidence is current for 16, so completion is 16 / 20 x 100 = 80%. This does not mean the business is 80% compliant. The four gaps need individual assessment and correction before any truthful validation statement.Case study
Seen in the real world.
This illustrative and entirely fictional example follows Luma Boutique, an invented online shop. Staff once copied card numbers from customer messages into its own checkout to complete phone orders. A review of the payment flow reveals that this practice puts sensitive data in places the team had not mapped. Luma switches to a hosted payment flow and trains staff to send customers to the provider's secure process. It removes the old card-entry workflow, checks where past messages were stored and asks its provider about retention and secure handling.
The team documents its responsibilities with the provider. The owner checks with the acquirer which assessment applies to the new setup. When Luma later changes its website, it reviews whether that change affects the payment page before reusing the prior answer. The lesson is not that hosting eliminates PCI duties; it makes the remaining duties easier to see and manage.
Watch out
Common mistakes.
- Treating a hosted checkout as automatic exemption from PCI DSS.
- Choosing an easier questionnaire without checking eligibility and payment flow.
- Calling an annual form proof that every system is secure.
Questions
People also ask.
Does PCI DSS apply to small businesses?
Yes. Even a merchant that outsources all processing has responsibilities and normally must validate under the route its acquirer or payment brand accepts.
Is PCI compliance a law?
It is an industry security standard; contractual validation and applicable law are separate questions. Ask the acquirer which validation it requires.
How can I make PCI compliance easier?
Map card-data flows, use an appropriate provider, then confirm the remaining controls and assessment route with the acquirer.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%