Costly mistakes, disputes and official sources
PCI DSS for small businesses in Australia: which self-assessment applies and what it costs
What PCI DSS requires of a small merchant, how to pick the right self-assessment questionnaire, non-compliance fees, card data you must never store, and links to Privacy Act breach rules.
If your business accepts card payments, your merchant agreement requires you to comply with the Payment Card Industry Data Security Standard (PCI DSS), the security standard maintained by the PCI Security Standards Council and enforced by card networks through acquirers. Most small businesses show compliance by completing a yearly Self-Assessment Questionnaire (SAQ), and sometimes quarterly network vulnerability scans. Which SAQ applies depends on how card data flows through your business: a café using standalone terminals has a much shorter questionnaire than an online store that handles card details on its own website. Many providers charge a monthly fee if you do not complete it. The current version of the standard is PCI DSS v4.0.1; check the Council's site for any newer version.
This guide is part of the overview of payment processing mistakes. It is general information; your provider tells you which validation it requires.
Who sets and checks what
| Body | Role |
|---|---|
| PCI Security Standards Council | Publishes PCI DSS, SAQs and supporting documents |
| Card networks | Decide who must validate compliance and how, and set merchant levels |
| Your acquirer or payment provider | Requires you to comply under the merchant agreement, collects your SAQ, may charge non-compliance fees |
| Qualified Security Assessors and Approved Scanning Vendors | Carry out assessments and external scans where required |
PCI DSS is a contractual industry standard, not an Australian law. Australian privacy and security laws apply alongside it.
Choosing your self-assessment questionnaire
| Your set-up | SAQ commonly used |
|---|---|
| Online store where all card entry happens on the provider's hosted page or redirect, no card data on your systems | SAQ A |
| Online store where your website controls or affects the payment page (for example, embedded scripts) but the provider receives card data | SAQ A-EP |
| Standalone terminals connected by phone line, or imprint machines only | SAQ B |
| Standalone, approved terminals connected over IP, not connected to other systems | SAQ B-IP |
| Card details keyed into the provider's web-based virtual terminal on one computer | SAQ C-VT |
| Payment application connected to the internet, no electronic card data storage | SAQ C |
| Validated point-to-point encryption (P2PE) solution | SAQ P2PE |
| PIN entry on a phone or tablet with a secure card reader, as part of a PCI-listed software-based PIN entry (SPoC) solution, card present only | SAQ SPoC |
| Anything else, including storing card data | SAQ D |
The eligibility criteria for each SAQ are detailed and were updated with v4.0.1; read them on the Council's site or ask your provider before choosing. Choosing a set-up that keeps card data off your systems (hosted pages, tokenisation, P2PE terminals) is the main way to keep your scope and effort small.
Card data rules everyone must follow
- Never store the card verification code (the three or four digits), PIN or full magnetic stripe or chip data after authorisation.
- Do not store full card numbers unless you really need to and can protect them. Most small businesses do not need to: use tokens instead.
- Never send card numbers by email, chat or text, and do not write them on paper order forms that are kept.
- Restrict access to payment systems and change default passwords on terminals, routers and POS systems.
- Keep software up to date, including POS, e-commerce plugins and terminal software.
- Check terminals for tampering, and keep a list of devices and serial numbers.
What non-compliance costs
Illustrative: a provider charges a $25 monthly PCI non-compliance fee until the SAQ is completed.
- One year without completing it: $25 × 12 = $300
- Time to complete SAQ B-IP for a small shop: perhaps one to two hours a year
If a data compromise occurs, the costs can be far larger: forensic investigation, network assessments passed on under the merchant agreement, card replacement costs, possible loss of the ability to accept cards, and reputational damage. Some providers offer PCI programmes, sometimes for a fee; check what they include.
Privacy and breach rules in Australia
If your business is covered by the Privacy Act 1988 (generally businesses with annual turnover above $3 million, and some smaller businesses such as health service providers), you must take reasonable steps to protect personal information under Australian Privacy Principle 11, and notify eligible data breaches likely to cause serious harm under the Notifiable Data Breaches scheme. Card and customer data can be personal information. Even if you are not covered, a breach can lead to contractual liability and loss of trust. The Australian Cyber Security Centre offers free guidance for small businesses.
A yearly PCI routine
- Confirm with your provider which SAQ and scans you must complete.
- Map how card data enters, moves through and leaves your business.
- Remove any stored card data you do not need.
- Complete the SAQ and any scans, and submit them by the due date.
- Train staff on card handling and phishing.
- Record changes during the year (new website, new POS) that could change your SAQ type.
Frequently asked questions
Do I need PCI DSS if I only use a phone tap-to-pay app?
Yes, you still accept cards, but your obligations are usually light. Your provider will tell you what to complete (for some phone-and-reader set-ups this is SAQ SPoC); follow its device security requirements.
Is my payment provider responsible for compliance?
The provider is responsible for its own systems. You are responsible for your environment, including how staff handle card details and how your website loads the payment page.
What if I take card numbers over the phone?
Key them straight into the provider's virtual terminal or secure system and do not write them down or store recordings that contain them. Ask your provider which SAQ applies.
Sources
- PCI Security Standards Council — PCI DSS v4.0.1, SAQs and eligibility criteria
- Office of the Australian Information Commissioner — Privacy Act, APP 11 and Notifiable Data Breaches
- Australian Cyber Security Centre — small business cyber security guidance
- Federal Register of Legislation — Privacy Act 1988
