Card Data Security Without a Consultant: The PCI Checks That Actually Matter in a Bristol Shop

Every few months a letter arrives from a card processor asking a Bristol independent to confirm its PCI DSS compliance. Most owners file it, mean to come back to it, and forget. The standard has a reputation for being either terrifying or entirely ignorable, and neither reading is accurate. For the great majority of small merchants the honest position is that a modest amount of housekeeping covers most of it, and a handful of habits cover nearly all of the risk.

First, work out which questionnaire applies to you

PCI DSS is not one document. It is a standard, and your obligations are set by the self-assessment questionnaire (SAQ) that matches how you take cards. PCI DSS v4.0.1 is the version your acquirer will be asking about in 2026, and the future-dated requirements from the earlier version have been mandatory since 31 March 2025.

• SAQ A applies where you never touch card data — typically an online shop using a hosted payment page, or a business that takes no card data at all.
• SAQ B covers standalone terminals that dial out over a phone line, and imprint machines.
• SAQ B-IP covers standalone terminals connected over the internet.
• SAQ C covers a terminal or PIN pad attached to a till or computer running payment software.
• SAQ P2PE applies where you use a validated point-to-point encryption solution — the shortest questionnaire available, and worth asking your provider about.
• SAQ D is the catch-all, and it is long. If you store card data in any form, this is likely to be you, which is a good reason not to.

Getting this wrong is the most common error. A shop running a till-integrated system on SAQ B-IP because that is what it filed three years ago is not compliant, whatever the certificate says.

The habits that do the heavy lifting

The technical requirements are extensive, but a small merchant's real exposure sits in a short list of behaviours.

Never store card numbers. Not in a booking system, not in a notebook, not in a WhatsApp thread where a customer has sent a deposit. Not photographed for the till roll. If a card number exists anywhere in your business outside the terminal, that is both a compliance failure and a genuine fraud risk.

Use the right equipment and look after it. A PCI-approved terminal with an integrated PIN pad encrypts data at the point of entry. Check the serial number against your asset list each quarter, inspect the casing for signs of tampering, and never let an unsolicited engineer swap or 'upgrade' a device.

Separate and secure your network. If your terminal shares a router with customer Wi-Fi, put it on a separate network. Change the default administrator password on that router the day it is installed. This one step blocks the majority of realistic attacks on a small retail setup.

Give everyone their own login. Shared passwords on the till, the payment portal or the email account are a standing finding in assessments. Turn on multi-factor authentication wherever it is offered, particularly on email and anything that can move money.

Train staff, and close the door behind leavers. A fifteen-minute briefing on card skimming, suspicious phone calls and what to do if a terminal behaves oddly satisfies the awareness requirement and, more usefully, actually works. Remove access for departing staff the same week.

The paperwork nobody warns you about

Three documents are worth having ready, because each is a specific requirement in v4.0.1 and each takes under an hour to produce.

1. A targeted risk analysis. A short written note explaining how often you review your card-data risks and why that frequency is sensible for a business of your size. Requirement 12.3.1 catches many small merchants simply because nothing is written down.
2. An incident response plan. Who calls whom, and within what window, if a terminal is tampered with or a card data breach is suspected. Your acquirer will expect prompt notification, and speed matters more than polish.
3. A current SAQ and attestation of compliance on file, with the renewal date diarised. Certificates lapse quietly, and a lapsed certificate is what triggers the non-compliance fee.

If your questionnaire requires quarterly external vulnerability scans, book them with an approved scanning vendor at the start of each quarter rather than in a panic at year end.

Where Bristol merchants most often trip up

The pattern repeats across the city. A salon in Redland takes a deposit by text message and screenshots the card. A clinic near Temple Quay keeps a spreadsheet of telephone payments. A retailer on a busy corner leaves the terminal on the counter overnight where a passer-by could reach it. A café shares a single till login across six staff, including two who left in the spring. A shop pays for a card-not-present service without checking whether the provider offers DTMF masking, which would take the whole operation out of scope.

None of these are exotic failures. All of them are fixable in an afternoon.

A working checklist

• Confirm which SAQ you should be filing, and ask your provider to confirm it in writing.
• Sweep the business for stored card numbers: booking systems, inboxes, notebooks, spreadsheets, messaging apps.
• Put terminals on a segregated network and change default router credentials.
• Issue individual logins and switch on multi-factor authentication.
• Diarise quarterly terminal inspections and annual staff refreshers.
• Write a one-page risk analysis and a one-page incident response plan.
• File the SAQ, keep the attestation, and set a reminder 60 days before renewal.

Compliance here is not a project you finish. It is a small set of routines that keep a non-compliance fee off the statement and, far more importantly, keep customer card details out of the hands of anyone who should not have them.