November 3, 2026 Compliance 7 min read

PCI DSS for Small Business in Canada

By Omer Segoly, CISM | Published November 3, 2026

PCI DSS for small business in Canada is a contractual obligation from the payment card brands, not a Canadian law. The PCI Security Standards Council states that PCI DSS applies to "all entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD) or could impact the security of the cardholder data environment." If your business accepts Visa, Mastercard, American Express, Discover, or JCB, you must comply. This guide covers what the standard requires, how merchant levels work, which Self-Assessment Questionnaire applies to your setup, and how to reduce your compliance scope. This is informational context (not legal or professional-standards advice); check with your acquirer and a Qualified Security Assessor for your specific situation.

What Is PCI DSS and Who Must Comply?

PCI DSS (Payment Card Industry Data Security Standard) is a baseline of technical and operational requirements designed to protect payment account data. The PCI Security Standards Council, founded by Visa, Mastercard, American Express, Discover, and JCB, owns and maintains the standard. According to the PCI SSC, the intended audience includes "all entities involved in payment card processing, including merchants, processors, acquirers, issuers, and service providers."

PCI DSS is not a Canadian statute. It is a contractual requirement: the card brands require compliance through their agreements with acquirers (the banks that process card payments for merchants). According to Visa's Account Information Security program, "acquirers must ensure that their merchants validate at the appropriate level."

What Changed with PCI DSS v4.0.1?

PCI DSS v4.0.1, published in June 2024, is a limited revision that clarified requirements from v4.0 but added no new requirements. The PCI SSC confirmed that the revision "does not impact the effective date of these new requirements."

According to the PCI SSC blog, "of the 64 new requirements, 51 are future-dated and will be effective as of 31 March 2025."

How Do Merchant Levels Work?

Each card brand defines merchant levels based on annual transaction volume. Validation requirements differ by level. According to Visa's Account Information Security program, "a merchant's total Visa transaction volume over a 12-month period determines your merchant level and the necessary requirements for validation."

Level 1 merchants (the highest volume tier) require an annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA). Most smaller merchants validate compliance through a Self-Assessment Questionnaire (SAQ). Your acquirer determines your level and can confirm which validation method applies to your business.

Which Self-Assessment Questionnaire Applies to Your Business?

The PCI SSC publishes multiple SAQ types. Which one applies depends on how your business accepts and processes card payments. The PCI SSC SAQ Instructions and Guidelines describes eligibility criteria for each:

• SAQ A: Card-not-present merchants (e-commerce or mail/telephone order) that have completely outsourced all account data functions to PCI DSS validated and compliant third parties. No electronic storage, processing, or transmission of account data on their systems or premises.
• SAQ A-EP: E-commerce merchants that partially outsource payment processing to PCI DSS validated and compliant third parties, with a website that does not itself receive account data but which does affect the security of the payment transaction. No electronic storage, processing, or transmission of account data on merchant systems or premises.
• SAQ B: Merchants using only imprint machines with no electronic account data storage, and/or standalone, dial-out terminals with no electronic account data storage. Not applicable to e-commerce channels.
• SAQ B-IP: Merchants using only standalone, PCI-listed approved PTS point-of-interaction devices with an IP connection to the payment processor. No electronic account data storage. Not applicable to e-commerce channels.
• SAQ C: Merchants with payment application systems connected to the Internet, no electronic account data storage. Not applicable to e-commerce channels.
• SAQ C-VT: Merchants that manually enter payment account data a single transaction at a time via a keyboard into a PCI DSS validated and compliant third-party virtual payment terminal solution. No electronic account data storage. Not applicable to e-commerce channels.
• SAQ P2PE: Merchants using only a validated, PCI-listed Point-to-Point Encryption solution. No access to clear-text account data and no electronic account data storage. Not applicable to e-commerce channels.
• SAQ D: All merchants not included in descriptions for the above SAQ types.

A small retailer using a hosted payment page from their payment processor would typically use SAQ A. A restaurant using a standalone chip terminal connected via IP would typically use SAQ B-IP. An online store that hosts its own checkout page (even if payment processing is outsourced) would typically need SAQ A-EP or SAQ D.

Your acquirer can help determine which SAQ applies. If you are unsure, consult a Qualified Security Assessor.

How Can Small Businesses Reduce PCI DSS Scope?

The PCI SSC Tokenization Guidelines state: "The key for merchants wishing to reduce their PCI DSS scope is to not store, process, or transmit cardholder data." Two technologies help:

Point-to-Point Encryption (P2PE): A PCI-validated P2PE solution encrypts cardholder data at the payment terminal and decrypts it only in a secure provider environment. Clear-text card data never enters your systems. According to the P2PE At a Glance, "merchants using PCI-listed P2PE solutions also have fewer applicable PCI Data Security Standard (PCI DSS) requirements."

Tokenization: Tokenization replaces the Primary Account Number (PAN) with a surrogate value (token) that has no exploitable value if stolen. The PCI SSC Tokenization Guidelines recommend: "Replace PAN storage with tokens wherever possible" and "Ensure all PAN and other cardholder data is removed from source systems once it has been tokenized."

Combining P2PE with tokenization provides the strongest scope reduction: P2PE protects the initial card capture and transmission, while tokenization protects any stored data needed for recurring transactions or refunds.

How Does PIPEDA Apply Alongside PCI DSS?

Canadian merchants must also comply with privacy law. PIPEDA Schedule 1 Principle 4.7 states: "Personal information shall be protected by security safeguards appropriate to the sensitivity of the information." Principle 4.7.1 specifies that "the security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification."

PCI DSS addresses cardholder data security specifically. PIPEDA addresses the broader collection, use, and disclosure of personal information. Both apply. Our guide to Canada's privacy landscape covers PIPEDA's 10 fair information principles and breach reporting obligations in detail.

The Office of the Privacy Commissioner expects organizations to implement physical, organizational, and technological safeguards. Several CCCS Baseline Controls align with PCI DSS requirements:

• BC.5 (Authentication): The Baseline Controls recommend implementing two-factor authentication wherever possible. PCI DSS Requirement 8.4.2 requires MFA for all non-console access into the cardholder data environment.
• BC.12 (Access Control): The Baseline Controls recommend provisioning accounts with minimum necessary access. PCI DSS Requirement 7 requires restricting access to cardholder data by business need to know.

See our guides to multi-factor authentication and vendor and third-party risk for practical implementation steps.

One Question to Ask Your Payment Processor

"Which SAQ applies to our payment setup, and does your solution include PCI-validated P2PE or tokenization?"

If your payment processor or acquirer cannot answer this question clearly, that conversation is where your PCI DSS review should start. The right payment setup can dramatically reduce your compliance burden while protecting your customers' card data.

Assess Your Overall Security Posture

Our free cybersecurity assessment evaluates your organization against the Canadian Centre for Cyber Security's 13 Baseline Control areas. The assessment covers 50 questions, takes under 30 minutes, and your answers stay in your browser. Progress is saved locally for 48 hours. No signup is required. The results show which control areas need attention. The assessment is not a PCI DSS assessment, QSA audit, or PIPEDA compliance audit; for those, consult qualified professionals.

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). PCI DSS for Small Business in Canada. Retrieved from https://cybersecuritycanada.ca/news/posts/pci-dss-for-small-business-in-canada/

Permanent URL: https://cybersecuritycanada.ca/news/posts/pci-dss-for-small-business-in-canada/ · Published November 3, 2026