Card Data Security Basics: What Small Merchants Should Know About PCI DSS

If your business, church or nonprofit accepts credit or debit cards, you have agreed, usually through your payment provider's terms, to protect card data according to an industry standard called PCI DSS. Many small merchants have never heard of it, or assume it only matters for large retailers.

The good news is that modern payment tools can take most of the burden off a small organization. Here is what PCI DSS is, how to keep your responsibilities small, and the everyday habits that matter.

This is general information, not legal or compliance advice. Your payment provider can tell you exactly what applies to your account.

What PCI DSS is

PCI DSS stands for Payment Card Industry Data Security Standard. It is maintained by the PCI Security Standards Council, an organization founded by major card brands. It applies to any organization that stores, processes or transmits cardholder data, regardless of size.

PCI DSS is enforced mainly through contracts: card brands require it, and your payment provider includes it in your merchant agreement. Requirements cover areas such as network security, access control, protecting stored data, monitoring and security policies.

How small merchants show compliance

Merchants are grouped into levels based on how many card transactions they handle each year. Most small businesses validate compliance by completing a Self-Assessment Questionnaire, often called an SAQ. There are several versions, and which one applies depends on how you accept cards. A merchant whose online payments are fully handled by a provider's hosted page completes a much shorter questionnaire than one whose own systems handle card numbers.

Ask your payment provider which questionnaire applies to you. Many providers offer tools that guide you through it.

Reduce your scope: keep card data off your systems

The most effective step is to make sure card numbers never pass through or rest in your own systems.

• Use hosted checkout pages or embedded payment fields from your provider, so card details go directly from the customer to the processor. Our guide to accepting online payments explains these options.
• Use your provider's saved-card features for repeat customers. These store a secure token instead of the card number.
• Never store full card numbers in spreadsheets, notes, email or customer files.
• Never store the card security code (the three or four digits on the card) after a payment is authorized. The standard prohibits it.

Everyday habits that protect card data

Never accept card numbers by email, text or chat

Ask customers to pay through a secure payment link instead. If someone sends a card number by email anyway, do not use or forward it; delete it and ask them to pay through your secure page.

Handle phone payments carefully

Enter card details directly into your provider's secure virtual terminal while on the call. Do not write them down.

Protect in-person equipment

Use card readers supplied or approved by your payment provider. Check devices regularly for signs of tampering, such as loose parts or unfamiliar attachments, which can indicate a skimmer. Keep terminals and devices that process payments off your guest Wi-Fi. Our guide to securing your Wi-Fi router covers separate networks.

Keep your website secure

Even with hosted payment fields, your website matters, because malicious code on a payment page could interfere with what customers see or type. Keep your website platform and plugins updated, limit who can edit payment pages and remove scripts you do not need. Newer versions of the standard pay closer attention to scripts running on payment pages.

Limit and train staff

Give payment system access only to people who need it, each with their own login and two-factor authentication. Make sure everyone who takes payments knows the rules above.

When something seems wrong

If you suspect card data has been exposed, such as a tampered reader or a compromised website, contact your payment provider immediately. They will guide you through the next steps. Preserve evidence and avoid wiping systems until you have advice.

The PCI Security Standards Council publishes official documents and resources at pcisecuritystandards.org.

Frequently asked questions

Does PCI DSS apply to small businesses?

Yes. It applies to any organization that accepts card payments, though small merchants who use hosted payment tools usually have far fewer requirements to meet.

If I use a payment processor, am I automatically compliant?

Not automatically. Using a processor's hosted tools greatly reduces your scope, but you still have responsibilities, such as completing the correct questionnaire and following safe practices for how you handle payments.

Can I keep card numbers on file for repeat customers?

Do not store card numbers yourself. Use your payment provider's saved payment or tokenization features, which let you charge returning customers without holding the card data.