SAQ D Too Complex? Here’s What Small Businesses Actually Need to Know About PCI Compliance

Bottom Line Up Front

You just received a PCI compliance questionnaire from your payment processor, and the internet is telling you that you need something called “SAQ D” — the longest, most complex self-assessment questionnaire with over 300 requirements. Take a deep breath. For most small businesses, SAQ D is overkill. In fact, the vast majority of small merchants qualify for much simpler questionnaires that take hours, not months, to complete. Let’s figure out what you actually need to do.

What Is PCI Compliance (In Plain English)

PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements created by the major credit card brands — Visa, Mastercard, American Express, and Discover. If you accept credit cards in any form, these requirements apply to you. Think of it as the card industry’s rulebook for keeping customer payment data safe.

The PCI Security Standards Council manages these standards, but your acquiring bank or payment processor (the company that handles your card transactions) enforces them. That’s who sent you the compliance questionnaire, and that’s who can fine you or even terminate your ability to accept cards if you don’t comply.

Here’s what non-compliance can cost you:

Monthly fines from your processor (typically $25-$100 for small merchants)
Liability for fraudulent charges if card data is stolen
Forensic investigation costs if you’re breached
Potential loss of your merchant account

But here’s the good news: most small businesses qualify for the simplest SAQ types that take a few hours to complete, not the dreaded SAQ D that everyone warns about online.

Do You Need to Be PCI Compliant?

Simple answer: if you accept credit cards in any form, yes. This includes:

Swiping, dipping, or tapping cards at a terminal
Taking payments through your website
Accepting payments over the phone
Processing cards through a mobile reader

Your merchant level determines how you prove compliance. Most small businesses are Level 4 merchants (processing fewer than 20,000 e-commerce transactions or up to 1 million total transactions annually). This means you can self-assess using an SAQ (Self-Assessment Questionnaire) rather than hiring a QSA for a full audit.

That questionnaire your payment processor sent? It’s their way of ensuring you’re following the rules. They’re required to verify that all their merchants maintain compliance, and they pass any card brand fines down to non-compliant merchants.

Which SAQ Do You Need?

The key to simplifying PCI compliance is choosing the right SAQ. There are several types, and picking the wrong one makes compliance unnecessarily complex. Here’s how to determine which one fits your business:

How You Accept Payments	SAQ Type	Number of Requirements	Complexity
Redirect to payment page (PayPal, Stripe Checkout)	SAQ A	22	Simple
E-commerce with payment fields on your site	SAQ A-EP	139	Moderate
Standalone terminal only (no connected systems)	SAQ B	41	Simple
Terminal connected to internet/network	SAQ B-IP	82	Moderate
Phone/mail orders, no electronic storage	SAQ C-VT	80	Moderate
Store card data electronically	SAQ D	329	Complex

Let’s break down the most common scenarios:

If you use a payment terminal (Square Stand, Clover, traditional credit card machine):

Terminal not connected to your computers or internet? → SAQ B
Terminal connected to internet for processing? → SAQ B-IP

If you have an e-commerce site:

Customers redirected to PayPal/Stripe/payment gateway? → SAQ A
Payment form embedded on your site (even if tokenized)? → SAQ A-EP

If you take payments over the phone:

Enter directly into virtual terminal, no recording/storage? → SAQ C-VT
Write down or save card numbers anywhere? → SAQ D (and please stop doing this)

PCICompliance.com’s SAQ Wizard asks you a few simple questions about how you accept payments and tells you exactly which questionnaire applies to your business — no guesswork required.

How to Complete Your SAQ

Once you know which SAQ applies, the actual process is straightforward:

1. Download or access your SAQ
Your payment processor may provide a link, or you can use PCICompliance.com’s guided questionnaire that walks you through each requirement.

2. Answer yes/no questions
Each requirement asks whether you have a specific security control in place. For example:

“Do you change default passwords on payment terminals?”
“Is your payment page served over HTTPS?”
“Do you have a process for installing security updates?”

“Yes” means you currently do this, not that you plan to. Be honest — false answers can result in liability if there’s a breach.

3. Gather supporting documentation
Depending on your SAQ type, you may need:

Network diagram (can be hand-drawn for simple setups)
Security policy documents
ASV scan results
List of who has access to payment systems

4. Complete quarterly ASV scans (if required)
SAQ types A-EP, B-IP, C-VT, and D require quarterly vulnerability scans by an Approved Scanning Vendor. This automated scan checks your internet-facing systems for security vulnerabilities. Schedule your first scan as soon as possible — it can take a few rounds to pass if issues are found.

5. Submit your compliance package
Once complete, you’ll submit:

Your completed SAQ
Attestation of Compliance (AOC) – a summary form stating you’ve met all requirements
ASV scan reports (if applicable)

Most payment processors have an online portal for submission. The whole process typically takes 2-4 hours for simple SAQ types, or several weeks for SAQ D.

What It Costs

Let’s talk real numbers for PCI compliance costs:

Compliance platform/tools: $100-500 annually

Guided SAQ questionnaire
Compliance tracking
Document templates
Remediation guidance

ASV scanning: $200-500 annually

Required quarterly for most SAQ types
Often bundled with compliance platforms
May need multiple scans to achieve passing status

If you need professional help:

Compliance consultant: $150-300/hour
Full QSA assessment (only for Level 1 merchants): $10,000-50,000

The cost of non-compliance:

Monthly fines: $25-100 for small merchants
Breach costs: $50,000+ for forensic investigation
Lost business during suspended card processing

For most small merchants, annual compliance costs less than two months of non-compliance fines. It’s not just about avoiding penalties — it’s about protecting your business and customers.

Staying Compliant Year-Round

PCI compliance isn’t a one-time checkbox — it’s an ongoing commitment. Here’s what that means in practice:

Annual requirements:

Complete your SAQ every 12 months
Review and update security policies
Verify all requirements still apply to your environment

Quarterly requirements (if applicable):

ASV scans must pass every 90 days
Review scan results and fix any failures
Keep scan reports for compliance records

Ongoing best practices:

Apply security patches promptly
Update passwords regularly
Train staff on security procedures
Document any changes to how you accept payments

When to reassess your SAQ type:

Adding new payment channels
Changing payment processors or gateways
Upgrading or replacing POS systems
Starting to store card data (don’t!)

PCICompliance.com’s compliance dashboard sends automatic reminders for quarterly scans and annual assessments, tracks your compliance status, and alerts you to any changes that might affect your SAQ type.

FAQ

Q: My payment processor says I need SAQ D, but I only have one credit card terminal. Why?

A: This is likely a miscommunication or incorrect SAQ assignment. SAQ D applies when you store cardholder data electronically. A standalone terminal qualifies for SAQ B or B-IP. Contact your processor to clarify — many default to SAQ D when unsure.

Q: Can I just say “yes” to all questions to pass quickly?

A: This is fraud and makes you fully liable for any breach. If you answer “yes” to encryption requirements but don’t actually encrypt, you’re personally responsible for breach costs. Answer honestly and fix any “no” answers.

Q: What happens if I ignore PCI compliance?

A: Your payment processor will start with warnings, then monthly fines. Eventually, they can terminate your merchant account, leaving you unable to accept credit cards. If you’re breached while non-compliant, you’re liable for all fraud and investigation costs.

Q: Do I need PCI compliance if I only process a few cards per month?

A: Yes. PCI DSS applies to any business that accepts credit cards, regardless of volume. However, your small volume means you’re a Level 4 merchant with simpler requirements — likely just an annual SAQ and quarterly scans.

Q: Is PCI compliance the same as being secure?

A: PCI DSS provides a security baseline, but it’s not comprehensive cybersecurity. Think of it as the minimum required to protect card data. Smart businesses use PCI requirements as a foundation for broader security practices.

Q: How do I know if I’m storing credit card data?

A: Search all computers, files, and databases for 16-digit numbers. Check email archives, spreadsheets, and accounting software. If you find any full card numbers, you’re storing card data and need SAQ D — or better yet, stop storing it immediately.

Conclusion

That PCI compliance questionnaire from your payment processor might have seemed overwhelming at first, but now you know the truth: most small businesses don’t need the complex SAQ D. By understanding how you accept payments and choosing the right SAQ type, you can achieve compliance in hours, not months.

The key is starting with an accurate SAQ assessment. Answer a few simple questions about your payment setup, and you’ll know exactly which requirements apply to your business. No more wondering if you need all 300+ requirements of SAQ D when a 22-requirement SAQ A would suffice.

PCICompliance.com makes the entire process manageable with our free SAQ Wizard that identifies your exact questionnaire type, ASV scanning service for your quarterly vulnerability scans, and a compliance dashboard that tracks everything year-round. Whether you’re completing your first SAQ or maintaining ongoing compliance, we provide the tools and guidance to protect your business without the complexity. Start with our free SAQ Wizard to see just how simple PCI compliance can be for your business, or reach out to our compliance team for personalized guidance.