PCI DSS compliance for Canadian small businesses, explained
If you accept cards, you have agreed to follow the Payment Card Industry Data Security Standard (PCI DSS). It is a set of security rules created by the card brands to protect card data. For most small businesses it comes down to a yearly questionnaire and a few good habits, not an expensive audit.
Who has to comply
Every business that accepts, processes or stores card payments, whatever its size. What changes with size is how you prove it. Small merchants almost always validate with a self-assessment questionnaire (SAQ) rather than an outside audit. The current version of the standard is PCI DSS 4.0.1.
Which questionnaire fits your setup
The questionnaire depends on how card data reaches you. The most common for small businesses:
- SAQ A: online only, with checkout fully handled by your processor's hosted page or redirect. The shortest one.
- SAQ B or B-IP: in-person only, with standalone terminals on a phone line or a secure IP connection, no card data stored.
- SAQ P2PE: terminals using a validated point-to-point encryption solution.
- SAQ C-VT: card details typed into a processor's virtual terminal in a browser.
- SAQ D: everything else, including storing card numbers yourself. The longest, best avoided.
Your processor or ISO can tell you which applies. If your setup mixes channels, ask, because the answer decides how much work compliance takes.
What it takes each year
The yearly routine is short:
- Complete the questionnaire on your processor's compliance portal.
- If you have an internet-facing card environment, run the required vulnerability scans.
- Keep terminals and POS software updated, and change default passwords.
- Never write down or store full card numbers, CVV codes or PINs, on paper or in a spreadsheet.
- Limit who can access payment systems, and give each person their own login.
Non-compliance fees
Many processors charge a monthly fee until the questionnaire is completed. It shows up on the statement as a PCI or non-compliance fee. Completing the questionnaire usually stops it. If you see this fee, ask your provider which questionnaire you need and where to complete it.
See also our compliance page for how SavPay handles security on its side.
Frequently asked questions
Do I need PCI compliance if I only use a terminal?
Yes, but it is usually the simplest case: a short questionnaire, kept up to date once a year.
Does using Square or a hosted checkout make me compliant?
It reduces what you have to do a lot, because card data never reaches your systems. You still have to follow the basic rules and, depending on your provider, confirm compliance.
What happens after a data breach?
You may face investigation costs, fines passed on by the card networks and reissuing costs. Following the standard is the best protection.