Requirements · Payment processing
Card data security requirements for merchants
Last updated 25 October 2026 · 2 sources listed · Reading time about 3 minutes
Short answer
Any business accepting cards must protect cardholder data under the card network security standard, validated through a questionnaire or assessment that depends on how you take payments. The less card data touches your own systems, the lighter the effort. Hosted checkout, encrypted terminals and tokenization shrink scope. Your acquirer or processor tells you which validation applies.
Who this is for: A business owner or operations manager who has been told they must be PCI compliant and needs to understand what that actually involves.
What to evaluate
Understanding your scope
Compliance effort follows the systems and people that store, process or transmit card data.
How to check: Draw a simple map of every place card details appear, including phone orders, email and paper.
Choosing a scope-reducing setup
Hosted fields and point-to-point encrypted terminals keep card data away from your network.
How to check: Ask providers whether their solution is listed by the standards body as validated.
Validation type
Merchants are grouped by volume and method, and each group has a different questionnaire or assessment.
How to check: Ask your acquirer which category applies to you and what the deadline is.
Network and device hygiene
Weak router settings, default passwords and unpatched systems are routine causes of breaches.
How to check: Keep an inventory of devices and confirm patching and password policies.
Staff practices
Writing card numbers down or taking them over unsecured channels creates exposure.
How to check: Train staff on handling rules and ban card details in email or chat.
Third-party service providers
You remain accountable for vendors who touch your payment flow.
How to check: Request evidence of each vendor's compliance status annually.
Incident response
A breach has reporting duties and forensic requirements that are hard to improvise.
How to check: Write a short response plan naming who calls the acquirer and the card networks.
Comparison
| Method | Typical effect on scope | Watch out for |
|---|---|---|
| Hosted payment page | Lowest burden; card data never reaches you | Redirect or script tampering on your own page |
| Encrypted point-to-point terminal | Small scope when properly validated | Using a terminal outside its validated configuration |
| Embedded provider fields | Reduced scope, though your page influences security | Your site code can still be attacked |
| Direct API collecting card numbers | Largest scope and full assessment | Storing data you do not need |
| Phone orders keyed into a virtual terminal | Moderate scope due to people and workstations | Notes and recordings that capture card numbers |
Decision worksheet
Rate up to three options against this guide’s own criteria. It runs in your browser and saves only on this device. It is a thinking aid, not a recommendation.
1. Have you checked each criterion?
0 of 7 criteria checked.
2. Compare options (0 = fails or unknown, 3 = meets it well)
| Criterion | |||
|---|---|---|---|
| Understanding your scope | |||
| Choosing a scope-reducing setup | |||
| Validation type | |||
| Network and device hygiene | |||
| Staff practices | |||
| Third-party service providers | |||
| Incident response | |||
| Total (max 21) | 0 | 0 | 0 |
Questions to ask before you commit
- Which validation questionnaire or assessment applies to my business?
- Does your solution keep card data off my network entirely?
- Is the product listed as validated by the standards body?
- What are the compliance deadlines and consequences if I miss them?
- Do you charge a fee for compliance programs, and what does it include?
- What do you provide if I suffer a suspected breach?
- How do you handle stored cards and tokens?
- Which of my staff need training?
Typical trade-offs
Outsource card capture entirely
- Upside
- Smallest compliance footprint and reduced breach exposure.
- Downside
- Less control over checkout design and dependence on the provider.
Accept phone orders
- Upside
- Helps customers who cannot or will not pay online.
- Downside
- Staff handling card numbers expands scope and risk.
Store cards for convenience
- Upside
- Faster repeat purchases and subscriptions.
- Downside
- Storing raw numbers creates liability; tokens are the safer route.
Common mistakes
- Treating compliance as a one-off form; the validation recurs and conditions change.
- Paying a compliance program fee and assuming it provides actual security.
- Keeping card numbers in spreadsheets or emails for convenience.
- Using default credentials on routers and terminals.
- Assuming a hosted provider's certification covers your own website.
Related questions
Who enforces the card security standard?
The standard is set by an industry council, but enforcement runs through the contractual chain: card networks require acquirers to ensure merchants comply, and acquirers pass the obligation to you in the merchant agreement. Non-compliance can bring fees, tighter terms or loss of the ability to accept cards, and a breach can lead to forensic costs. Laws about data protection may apply separately, depending on where you operate.
Does a small business really need to validate?
Yes, in principle. Every merchant accepting cards is expected to protect data, though smaller merchants usually complete a short self-assessment instead of an on-site audit. The questionnaire form depends on your processing method. If you use a certified terminal or hosted checkout, the form is brief. Ask your acquirer which one to use and where to submit it.
What is tokenization and why does it help?
Tokenization replaces the real card number with a meaningless reference that is useless to an attacker if stolen. The real number sits in the provider's secured vault, and you store only the token for repeat billing or refunds. Because you do not hold sensitive data, your scope shrinks and a breach of your systems exposes far less. Tokens are usually tied to the issuing provider, which matters when you consider switching.
What happens if we suffer a breach?
Typically you must notify your acquirer promptly, preserve evidence, and may need to engage an approved forensic investigator. Costs can include investigation, card reissuance charges passed through the networks and possible penalties. Separate legal duties, such as notifying regulators or affected people, vary by jurisdiction. A written plan prepared in advance shortens response time and clarifies who does what.
Are compliance fees from my provider legitimate?
Some providers run programs that bundle a questionnaire portal, scanning and limited breach assistance, and charge for it. Others charge a non-validation penalty if you do not complete the form. Ask exactly what the fee covers, whether it is optional, and what a failure to validate costs. A fee never replaces your obligation to actually secure your systems.
Sources and further reading
These pages were reachable when we last checked. They informed definitions and rules referred to above; they do not endorse this guide. Where rules differ by country, check the authority for your location.
- PCI Security Standards Council — PCI Security Standards Council, retrieved 27 October 2026
- Business Guidance — US Federal Trade Commission, retrieved 27 October 2026
Related guides
How to choose · Payment processing
How to choose a payment processor for a small business
Start with how you sell: in person, online, by phone or through invoices. Then compare pricing structure, settlement speed, reserve and hold policies, dispute handling, contract exit terms and how well the gateway connects to your accounting and ordering systems. Pricing is rarely the only difference; a cheap headline structure can hide holds, minimums and early termination clauses. This page covers how to evaluate, not which provider to pick.
Comparison · Payment processing
Payment gateway versus merchant account: what each does and when you need both
A merchant account is the arrangement that lets you receive card funds into a bank account; a payment gateway is the software link that securely passes card details from checkout to the processor. Bundled providers hide the split, while unbundled setups give you more control and more paperwork. The right structure depends on volume, technical ability and how much you want to negotiate separately.
Problems & fixes · Payment processing
Hidden costs and problem clauses in payment processing contracts
Processing contracts often look simple on the first page and shift cost into minimums, statement and compliance fees, early termination charges, equipment leases and rate-change rights buried later. Review the schedule of fees, auto-renewal, liability for chargebacks and the provider's right to alter terms. Ask for everything in writing and have a professional adviser read the agreement before you commit.
Requirements · POS systems
Requirements a restaurant POS must meet for tax, receipts and compliance
A POS must calculate the correct tax on each item, keep audit-friendly records, produce compliant receipts, protect card and staff data and support the record retention your authorities require. Some countries mandate certified fiscal devices. Rules differ by jurisdiction, so check with your tax authority and an adviser, then verify the vendor supports your local requirements.
Problems & fixes · Office equipment
Common problems with office equipment leases and service contracts
Typical problems are automatic renewals, excess page charges, bundled service that excludes common faults, slow repair response, and return disputes. Prevent them by reading the contract for volumes, exclusions and notice dates, logging every fault and response, and asking for a clear end-of-term procedure. When disputes arise, keep records and escalate in writing.
How to choose · B2B software
How to run a security review of a SaaS vendor
Scale the review to the data and access the vendor will have. Collect independent assurance reports, a completed security questionnaire and documentation on encryption, access control, incident response and subprocessors, then verify claims rather than accepting them. Focus on what the vendor does with your data, how it detects and reports incidents, and how you can exit with your data intact.
Requirements · Professional services
Outsourcing contracts and service levels: what to require
A robust outsourcing agreement defines the scope in measurable terms, sets service levels tied to business outcomes, links remedies to performance, protects data and audit rights, manages change and subcontracting, and plans the exit. Service levels fail when they measure what is easy rather than what matters or when remedies are too small to influence behaviour.