What is PCI compliance? A plain guide for small salons and shops
PCI DSS explained for small business owners: what your shop must do, the yearly self-assessment questionnaire, and simple habits that keep card data safe.
Short answer: PCI DSS is the card brands' security standard for anyone who accepts cards. For a small shop using a modern terminal, compliance usually comes down to three things: never store card numbers, keep your terminal and network secure, and complete a self-assessment questionnaire (SAQ) every year.
What is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is set by a council formed by the major card brands to protect cardholder data. It isn't a government law, but your processor agreement requires it. If card data leaks, a business can face fines and investigation costs.
What does a small shop need to do?
- Never store card numbers anywhere: no notebooks, photos, phones or spreadsheets.
- Use a modern terminal: one that supports chip and tap and encrypts card data as it's read.
- Protect your Wi-Fi: keep guest Wi-Fi separate from the network your checkout runs on, and change default passwords.
- Inspect your terminal regularly: look for anything attached to the card slot that shouldn't be there.
- Complete your SAQ every year: your processor usually sends a link or has a portal.
What is the SAQ?
The Self-Assessment Questionnaire is a set of yes/no questions about how you accept cards. There are several versions depending on your setup. Shops using semi-integrated or point-to-point encrypted terminals usually have a much shorter questionnaire than shops typing card numbers into a computer. Your processor will tell you which one applies.
Common mistakes
- Keeping regular clients' card numbers on file to "charge later" or hold a spot.
- Taking card numbers by text or phone and writing them down.
- One shared password for every staff member on the checkout computer.
- Ignoring SAQ reminder emails and paying a monthly non-compliance fee.
How does your POS software affect PCI?
If card numbers flow through your POS software, that software is in PCI scope too. With a semi-integrated setup, card data stays in the terminal and with the processor, so the software never sees or stores it.
Kashela never receives, stores or logs full card numbers or security codes. Refunds and voids require a manager, and every action is logged. Read more about semi-integrated payments.
This article is general information and doesn't replace official guidance from your payment processor.
Frequently asked questions
Do small businesses need to be PCI compliant?
Yes. Every business that accepts cards must follow PCI DSS, regardless of size. For small shops the main task is usually a yearly self-assessment.
What is a PCI non-compliance fee?
A monthly fee some processors charge until you complete your self-assessment questionnaire. Completing it usually removes the fee.
Can I write down a client's card number to hold an appointment?
You shouldn't. Writing down or storing card numbers is the biggest risk. Use deposits through your processor instead of keeping card numbers.