What is PCI DSS? The rules for handling card details
By SendPay Business · · 2 min read
PCI DSS, the Payment Card Industry Data Security Standard, is a set of security rules for any business that takes, stores or passes on card details. It's run by the PCI Security Standards Council, which was set up by the major card schemes.
Who it applies to
Any business that accepts card payments is expected to follow it, from a market stall to a large retailer. The work involved depends on how many card payments you take and how card details reach your systems.
What it asks for
- Protect card data and don't store what you don't need.
- Keep systems patched, use firewalls and strong passwords.
- Limit who can see card details and log access.
- Test security regularly and have a security policy.
How small businesses show compliance
Most small businesses fill in a Self-Assessment Questionnaire (SAQ) each year, often through their payment provider. The simplest questionnaires apply when card details never touch your own systems.
Keeping card numbers off your systems
Using a hosted payment page or payment links means the customer types their card details on the provider's page, not yours. That can greatly reduce how much of PCI DSS falls on you. Never write down card numbers taken over the phone.
Where SendPay fits
SendPay platforms include payment links and invoicing under your own brand, powered by licensed partners, so customers pay on a secure page rather than reading card numbers to you. You can preview your platform before you pay.
Build it
Create your own financial platform.
Pick a template, name it, brand it, preview every page before you pay. Your brand, your users, your fees.
Build my platform →Questions people ask
What is card tokenisation?
How card numbers are replaced with safe tokens.
What is card tokenisation? →Virtual terminal or payment link?
Which keeps card numbers out of your hands.
Virtual terminal vs payment links →Read next
This guide is general information, not legal or financial advice. SendPay Business is a technology company, not a bank, and does not take deposits; regulated services on the platforms are provided by licensed partners. PayPal, Patreon and Substack are named as reference points only and are not affiliated with SendPay Business.