What PCI is
PCI stands for Payment Card Industry. The PCI Data Security Standard, often shortened to PCI DSS, is a set of security requirements for any business that stores, processes or transmits payment card data. It was created by the major card brands and is maintained by an industry body they founded. It is not a law in most places, and it is not a government regulation. It is a set of rules enforced through contracts: a business that accepts cards agrees, usually through its payment provider, to follow it.
The purpose is to reduce theft of card numbers. If a store keeps card details on its own servers and is hacked, thousands of customers can be affected. The standard tries to make sure that anyone who handles card data protects it.
Who it applies to
In principle, every business that accepts card payments, however small. In practice, what the standard asks of a business depends on how card data flows through it. A store that never sees or touches card numbers has far less to do than one that takes numbers on its own website and passes them on.
That is the key idea for a small shop: your obligations depend mostly on your payment setup.
Why the payment setup decides most of it
Think of three broad arrangements.
- Fully hosted payment page. The customer is sent to a page run by the payment provider, or the card fields are served directly from the provider and never pass through the store’s own servers. The store handles an order and a confirmation, not the card number. This typically means the lightest set of requirements.
- Embedded fields from a provider. The checkout looks like part of the store, but the card entry fields are supplied by the provider and the numbers go straight to them. The store’s own pages still have to be secure, because tampering with a page could affect where the data goes. The requirements are small but not zero.
- Taking card numbers directly. The store’s own server receives the card data and forwards it. This brings the largest set of requirements, including detailed technical controls, and carries the highest risk. Most small stores have little reason to choose it.
The same reasoning is why many small sellers choose a payment gateway that takes card data off their hands. The comparison of payment gateways looks at other differences, but data handling is a major one.
On a hosted store builder, the platform usually runs checkout and is responsible for much of the underlying security. The owner still has duties, such as protecting admin logins and completing any paperwork the provider requests. Self-hosted stores put more of this on the owner.
What the paperwork looks like
Businesses are often grouped into levels, mainly by how many card transactions they process each year. Small stores usually sit in the lowest group. Typically such a business is asked to complete a self-assessment questionnaire, a checklist of statements about how it handles card data, and sign an attestation that the answers are true. There are different versions of the questionnaire depending on the setup, with the shortest ones for businesses that fully outsource card handling.
Payment providers often send reminders or provide a portal for this. Some charge a fee if the paperwork is not completed. Read those emails, because they can be mistaken for scams, and fake PCI notices do exist. It helps to log in to the provider’s dashboard directly instead of clicking a link in a message, a habit also covered in the article on phishing scams.
Larger businesses, and those with higher volumes, may face extra requirements such as external scans or audits. The exact thresholds and rules come from the card brands and providers and change over time, so check the current version with your provider.
What the standard generally covers
At a high level, the requirements fall into themes that will look familiar:
- Secure networks and systems, with firewalls and sensible configurations.
- Protecting stored card data, and avoiding storing it at all where possible.
- Encrypting card data when it travels over public networks.
- Keeping software updated and protecting against malicious software.
- Restricting access to data on a need-to-know basis, with unique logins and strong authentication.
- Monitoring and testing systems regularly.
- Keeping a written security policy.
These overlap with general cybersecurity basics and other security best practices, which is why a store that already takes security seriously is partway there.
Common misunderstandings
- “PCI compliance means we are secure.” Not exactly. It sets a baseline and is a point-in-time claim. Real security takes continuing attention.
- “The platform handles it, so I have nothing to do.” The platform may cover its part, but the owner generally still has to confirm the store’s own responsibilities, complete any questionnaire and protect accounts.
- “We never store card numbers, so it does not apply.” It may apply in a lighter form. Handling any part of the payment flow, including pages that lead to it, can matter.
- “Writing down a customer’s card number is fine if it’s just for a moment.” Taking numbers by email, chat, phone notes or spreadsheets creates storage that is difficult to secure. It is generally best avoided, and a customer who sends a number in an email should be asked to use the proper checkout instead.
Practical steps for a small store
- Find out how your checkout handles card data: hosted page, embedded fields or direct.
- Prefer a setup in which card numbers never reach your servers.
- Check what your payment provider asks you to complete, and by when.
- Use strong logins for every admin and staff account, with two-factor authentication where available.
- Keep platform software, plugins and themes updated.
- Never record card numbers outside the payment system.
- Keep a note of what you did and when, in case the provider asks.
Penalties and obligations differ by country, card brand and provider, and this article is general information, not legal or compliance advice. If the store takes card data directly, or handles a high volume, a qualified security assessor can explain the exact requirements.