Question 1

Does a small business need PCI compliance?

Accepted Answer

Yes. Every business that accepts, stores, processes, or transmits card data must comply with PCI DSS, regardless of size. The bar is lower for small merchants (typically SAQ A or SAQ B-IP) but it is not zero. A merchant on a fully hosted checkout answering SAQ A faces around 24 controls, against roughly 251 on SAQ D, and that gap is the whole reason the architecture choice matters more than any negotiation. The one published price at this end of the market is SecurityMetrics' small-business bundle at $399 per year (securitymetrics.com, checked July 2026), which covers a single-IP scan and an SAQ portal rather than a general market rate.

Question 2

How much does PCI compliance cost for a restaurant?

Accepted Answer

Nobody publishes a price for it, so the useful answer is what decides it. Modern POS platforms (Toast, Square, Clover) carry the card data on their own systems and their own certification, which minimises the merchant's obligation and usually lands you on a short SAQ. Restaurants using legacy POS terminals, or holding card data for tip adjustment, can land on SAQ C (160 controls) or SAQ D (around 251) instead of SAQ B-IP (82) or SAQ P2PE (33). That control count is what a quote gets built on, so the terminal and the tip-adjustment flow are where a restaurant's PCI bill is actually set.

Question 3

Do online-only businesses need PCI compliance?

Accepted Answer

Yes. Card-not-present merchants are explicitly in scope. Most e-commerce shops on hosted checkout (Stripe Checkout, PayPal) qualify for SAQ A at around 24 controls, and on Stripe's published position provider-hosted embedded fields like Stripe Elements are also within SAQ A, because the card inputs sit in an iframe served from Stripe's domain rather than yours. What lands you on SAQ A-EP at around 139 controls, roughly six times as many, is a direct-post integration or your own card fields and scripts on the payment page, largely because of the script-management controls under Requirement 6.4.3. Neither SAQ has a published completion price, and the control ratio is the honest way to size the difference. Confirm your own SAQ type against the SAQ document and your acquirer.

Question 4

Is PCI compliance different for healthcare?

Accepted Answer

PCI applies the same way it does anywhere else, but most healthcare organisations also fall under HIPAA, and the two overlap on the substance rather than the paperwork: encryption, access management and audit logging are asked for by both. That overlap reduces the marginal cost of PCI for an organisation already meeting the HIPAA Security Rule, because the controls exist and the evidence is being produced already. We put no percentage on the overlap and no figure on the combined cost, because neither is published and both depend on your own control implementations rather than on the two frameworks in the abstract. Note the trap: HIPAA compliance does not put you in PCI scope or out of it. Your card data flows decide that, independently.

Question 5

Do I need PCI compliance if I use Shopify?

Accepted Answer

Yes, but Shopify Payments handles most of the technical controls. Shopify is itself a PCI Level 1 service provider and processes card data on its infrastructure. Merchants using Shopify Payments typically qualify for SAQ A. If you use a third-party payment gateway through Shopify, you may need SAQ A-EP depending on how the integration handles card data.

Industry	Typical level	Common SAQ	What drives the bill here
Retail (Brick & Mortar)	Level 3-4	SAQ B-IP, C, or P2PE	POS terminal security, wifi network segregation, multi-location consistency, seasonal staff training, POS device tampering inspection.
E-commerce	Level 3-4	SAQ A or A-EP	Payment page script security (Req 6.4.3), JavaScript monitoring, third-party code on checkout pages, SAQ A vs A-EP determination.
Restaurant & Hospitality	Level 4	SAQ B-IP or P2PE	Tip adjustment and pre-auth flows, card-present terminals in high-traffic areas, hotel booking systems storing card data, staff turnover.
Healthcare	Level 4	SAQ C or D	PCI + HIPAA overlap, patient payment portals, legacy systems in clinical environments, network segmentation complexity.
SaaS & Subscription Billing	Level 2-3	SAQ D (Service Provider)	Recurring card-on-file storage, service provider obligations, multi-tenant environments, API security, higher scope than merchants.
Call Centre	Level 2-4	SAQ C-VT or D	DTMF masking for phone payments, call recording with card data, agent access controls, clean desk policy, screen capture prevention.

PCI compliance cost by industry

What sets the cost in each sector

Retail (Brick & Mortar)

E-commerce

Restaurant & Hospitality

Healthcare

SaaS & Subscription Billing

Call Centre

Need an independent assessment?

Frequently asked