PCI DSS Compliance Guide for SMEs

Do You Need PCI DSS?

If your business accepts, processes, stores, or transmits credit card data, you need PCI DSS compliance. This applies to all businesses regardless of size.

PCI DSS Levels

• Level 1: More than 6 million transactions/year — annual ROC by QSA
• Level 2: 1-6 million transactions/year — annual SAQ
• Level 3: 20,000-1 million transactions/year — annual SAQ
• Level 4: Fewer than 20,000 transactions/year — annual SAQ

Key Requirements

• Do not store card data (use tokenisation via payment gateway)
• Use HTTPS for all payment pages
• Apply security patches promptly
• Restrict access to cardholder data
• Monitor and test networks regularly