PCI DSS and SAQ A

PCI DSS is the card industry’s security standard, and every business taking card payments is subject to it. How much of it you have to evidence depends on how card details are handled, which is what the self-assessment questionnaires are for. SAQ A is the shortest, and it is available only to merchants who fully outsource card handling, so no card data is stored, processed or transmitted on their own systems.

In practice

PCI DSS is the card industry’s security standard, and every business taking card payments is subject to it. How much of it you have to evidence depends on how the card details are handled, which is what the different self-assessment questionnaires are for.

SAQ A is the shortest, and it applies to merchants who fully outsource card handling, so no card data is stored, processed or transmitted on their own systems. In practice that means the card fields belong to the payment provider — hosted fields or a hosted page — rather than being collected by your site and passed along.

This is a design decision, not a paperwork one, and it is worth getting right at the start: a checkout built so card details never reach your server keeps you in the easiest bracket permanently.

Also called: PCI compliance, SAQ A.

Questions people ask about pci dss and saq a

Who can use SAQ A?

Merchants who take card-not-present payments and have outsourced card handling entirely, so no card data touches their own systems. In practice that means the card fields belong to the payment provider - hosted fields or a hosted page - rather than being collected by your site and passed along.

Is PCI compliance a paperwork exercise?

The questionnaire is paperwork; which questionnaire you are allowed to use is a design decision. A checkout built so card details never reach your server keeps you in the shortest bracket permanently, and that is settled when the checkout is built rather than when the form arrives.

Does using a payment provider make me compliant automatically?

It makes the easiest bracket available to you; it does not fill the form in. You still confirm your providers are compliant, and you still have to avoid quietly reintroducing card data - a phone order written on a pad, an email with a card number in it - which is the commonest way the bracket is lost.

Sources, checked 26 October 2026

PCI Security Standards Council, Document Library: where PCI DSS and the self-assessment questionnaires are published