Compliance Assessment ToolHome › PCI compliance by business
PCI compliance by type of business
Which PCI form you need depends on how you take cards, not on your industry. But businesses in the same industry tend to take cards the same few ways, so start with yours.
Hotels and lodging
Front desk, booking engine, phone bookings, OTA virtual cards: each is its own payment method and SAQ. A plain-English PCI guide for hotels and inns.Restaurants, bars and cafes
Counter terminal, POS, pay-at-table, online orders, phone orders: each is its own payment method and SAQ. Plain-English PCI for restaurants and bars.Retail stores
Shops take cards several ways: counter terminal, POS system, phone reader, online store. Each is its own payment method with its own PCI SAQ.Salons, spas and barbershops
Salons take cards several ways: booking-app deposits, the front-desk terminal, phone bookings. Each is its own payment method with its own PCI SAQ.Medical, dental and veterinary offices
Which PCI SAQ does a medical, dental or vet practice need? Front-desk terminals, patient pay links, phone payments, cards on file, and why HIPAA differs.Small online stores
Which PCI SAQ does a small online store need? Hosted checkouts, embedded card fields, WooCommerce plugins, payment links and marketplaces, explained.Contractors and home service pros
Which PCI SAQ do plumbers, electricians, HVAC techs and cleaners need? Invoice pay links, phone card readers and phone payments: one SAQ per method.Nonprofits and charities
Do nonprofits need PCI compliance? Yes, if you take card donations. Which SAQ fits donation pages, event readers, pledge cards and text-to-give.
Front desk, booking engine, phone bookings, OTA virtual cards: each is its own payment method and SAQ. A plain-English PCI guide for hotels and inns.Restaurants, bars and cafes
Counter terminal, POS, pay-at-table, online orders, phone orders: each is its own payment method and SAQ. Plain-English PCI for restaurants and bars.Retail stores
Shops take cards several ways: counter terminal, POS system, phone reader, online store. Each is its own payment method with its own PCI SAQ.Salons, spas and barbershops
Salons take cards several ways: booking-app deposits, the front-desk terminal, phone bookings. Each is its own payment method with its own PCI SAQ.Medical, dental and veterinary offices
Which PCI SAQ does a medical, dental or vet practice need? Front-desk terminals, patient pay links, phone payments, cards on file, and why HIPAA differs.Small online stores
Which PCI SAQ does a small online store need? Hosted checkouts, embedded card fields, WooCommerce plugins, payment links and marketplaces, explained.Contractors and home service pros
Which PCI SAQ do plumbers, electricians, HVAC techs and cleaners need? Invoice pay links, phone card readers and phone payments: one SAQ per method.Nonprofits and charities
Do nonprofits need PCI compliance? Yes, if you take card donations. Which SAQ fits donation pages, event readers, pledge cards and text-to-give.
The one rule to know
Every way you take cards is a separate payment method with its own Self-Assessment Questionnaire (SAQ). A card terminal at your counter and an online booking page are two payment methods, so two SAQs, and usually two short ones, rather than one long one.
Find out which SAQ fits each way you take payments, free
Describe how you take payments in your own words. We'll tell you which SAQ fits each one, free, before you pay anything.
General guidance, not legal advice. Your acquirer or payment processor decides which SAQ you must file.