What PCI actually is
Canadian store operators who take online payments still need PCI compliance for small business, because every shop that accepts cards must follow the rules. PCI DSS is a set of security rules created by the card networks to protect cardholder data. Every business that accepts cards must comply, but the effort scales with how you handle card data. If you never touch raw card numbers, your obligations are light.
The SAQ: your main task
Most small merchants complete a Self-Assessment Questionnaire (SAQ) once a year, a checklist confirming you follow basic security practices for the way you take cards. The right SAQ type depends on that setup. Hosted checkout, where the card is entered on the processor's page, qualifies for the shortest one. A custom form on your own server pushes you into a much larger questionnaire. Complete the form for the checkout you run today, save the PDF with the date, and redo it if you later add a plugin that collects card numbers on your site. For a small store, this annual checklist is the main PCI task.
How to shrink your scope
Use hosted checkout or tokenization so card data is entered on your provider's secure systems, not yours. This is the single best way a small store can shrink what it is responsible for. Keep your colours around the hosted page and drop the custom fields that posted numbers to your server. Phone orders belong in the virtual terminal, and the card stays out of email and booking notes. See connecting a gateway the right way. Finish that move, then complete the SAQ for the checkout you actually run. Remove any new plugin that asks you to collect the raw card number on your own page.
Staying compliant year-round
Complete your SAQ annually, keep software updated, use strong passwords that are not shared, and never store raw card numbers in email, notes, or a spreadsheet. If a plugin wants the card number on your page, remove it before you sign the next questionnaire. Staff who take phone orders should use the virtual terminal only. Armour Payments provides PCI-compliant infrastructure, so hosted card entry leaves most of the heavy lifting with the processor. Block one afternoon a year, answer for the checkout you run, and save the PDF with the date. Contact sales if you are unsure which SAQ fits hosted checkout.
The custom card form a small shop pasted into its theme
A small shop pasted card fields into the theme so the boxes would match the site font. Raw card numbers touched the store server. The annual SAQ, which had been a short checklist, became a much larger job, and a theme update broke the form on a Friday afternoon. Moving card entry to hosted checkout put the numbers back on the processor's page. The shop kept its colours around that page and dropped the custom fields. That scope cut is the one that matters for a small store. Connection steps are in connecting a gateway. Complete the SAQ after the change, so you answer for the checkout you actually run. Questions about which SAQ fits go to contact sales.
A yearly pass that takes one afternoon
Block one afternoon a year and complete the self-assessment against the checkout you actually run. Confirm you are on hosted fields or tokenization, that nobody is storing cards in email, and that admin passwords are not shared. Complete the SAQ that matches that setup. Hosted checkout is the short questionnaire. Save the PDF with the date next to it. If a new plugin "just needs the card number," remove it before you sign the form. Staff who take phone orders should use the virtual terminal only, and the card should not land in a booking note. Update the store software when the platform asks. Fraud controls are a separate habit, covered in card-not-present fraud prevention. Payment options are on online payments.