PCI Compliance for Small UK Businesses: A Practical Guide
PCI DSS applies to the smallest shops, cafés and sole traders too — but the path to compliance is short. Here is the minimum a small UK business actually needs to do.
Many small business owners assume PCI DSS is only for big retailers. It is not. If you take card payments at all — even a handful a week through a single terminal or a simple online checkout — PCI DSS applies to you. The reassuring news is that for most small UK businesses the route to compliance is short and inexpensive.
You are almost certainly a Level 4 merchant
PCI DSS sorts merchants into four levels by annual card transaction volume. Almost every small UK business — processing well under 20,000 e-commerce transactions a year — falls into Level 4, the smallest category. Level 4 merchants validate compliance with a Self-Assessment Questionnaire rather than an external audit, which keeps the burden low.
The minimum you need to do
- Work out how you take payments (terminal, hosted online checkout, phone, or a mix).
- Identify and complete the correct — and simplest valid — SAQ for that setup.
- Make sure you never write down or store full card numbers.
- Use PCI-approved terminals and keep them (and any software) up to date.
- Run a quarterly vulnerability scan if your setup requires one.
- File your validated compliance with your acquirer, and repeat each year.
Choosing the right questionnaire is the part that trips small businesses up — see SAQ A vs SAQ D explained. Get it right and a small business is often dealing with a 30-question form, not a 250-question one.
What it costs
For a typical small UK business, compliance should cost a small, predictable amount each year — far less than the non-compliance fees acquirers add when you do not validate. We break the numbers down in how much PCI compliance costs in the UK. Fraud Defence First handles the whole thing for a flat £100 + VAT a year.
Keep it simple
Small businesses rarely have time to learn PCI jargon or chase acquirer portals. A fully managed PCI service confirms your SAQ, completes the paperwork, manages any scans and files everything for you — usually within 24 hours. For the full background, read the complete PCI DSS guide.