PCI DSS Compliance
If your business stores, processes, or transmits payment card data, PCI DSS applies. We help you understand your scope, complete your SAQ, and align your cardholder data environment with the standard.
Who Does PCI DSS Apply To?
PCI DSS applies to any organisation that stores, processes, or transmits payment card data — or that could affect the security of cardholder data.
Merchants Accepting Card Payments
Any business accepting Visa, Mastercard, or other payment scheme cards must comply — from sole traders using a card reader to large e-commerce retailers processing millions of transactions.
Service Providers
Technology companies, payment processors, hosting providers, and SaaS platforms that store, process, or transmit cardholder data on behalf of merchants.
Reducing Your Scope
Using a fully hosted payment page or tokenisation can dramatically reduce what PCI DSS applies to in your environment. We help you understand your current scope — and whether there are sensible ways to shrink it.
PCI DSS v4.0.1
PCI DSS v4.0.1 is the current version. The transition from v3.2.1 was required by 31 March 2025. New future-dated requirements became mandatory from 31 March 2025. We assess your environment against the current version.
Our PCI DSS Compliance Services
We support merchants and service providers from first assessment through to SAQ completion, remediation, and privacy alignment.
Gap Assessment
A review of your cardholder data environment against PCI DSS v4.0.1 requirements — identifying what you meet, what you need to fix, and what controls are missing.
SAQ Completion Support
We work with you to select the right SAQ type for your environment, gather the evidence needed for each requirement, and complete the self-assessment questionnaire accurately.
Scope Definition
Defining your cardholder data environment (CDE) accurately — including connected systems, cloud environments, and third-party integrations — so your compliance efforts focus on the right place.
Remediation Planning
A prioritised plan to close the gaps found in the assessment — with clear ownership, timelines, and guidance on the most cost-effective way to reach compliance.
Privacy and GDPR Alignment
Card data is personal data under UK GDPR. We align your PCI DSS controls with your GDPR obligations — covering retention, security, and breach notification requirements under both frameworks.
Ongoing Compliance Support
Annual reassessment support, policy maintenance, and tracking of PCI Security Standards Council guidance — keeping your compliance current as your payment environment evolves.
Which SAQ Type Applies to You?
PCI DSS self-assessment questionnaires differ depending on how you take card payments. Using the wrong one is a compliance risk.
| SAQ Type | Who It Applies To | Typical Size |
|---|---|---|
| SAQ A | Card-not-present merchants using fully outsourced payment pages | Small e-commerce merchants |
| SAQ B | Merchants using standalone dial-out terminals only | Retail merchants with no e-commerce |
| SAQ B-IP | Merchants using IP-connected standalone terminals | Retail merchants |
| SAQ C | Merchants with payment applications connected to internet | SME merchants |
| SAQ D (Merchant) | All merchants not covered by other SAQ types | Complex environments |
| SAQ D (Service Provider) | All service providers eligible to complete an SAQ | Technology and hosting companies |
Tom S.
Medical Practice
"Improved control over sensitive medical data"
"Practical guidance on access controls and data protection. Helped define structured access policies and introduced tokenisation for patient identifiers used in analytics."
Sarah S.
Retail, Enterprise
"Reliable partner for telecom data protection"
"Quickly understood telecom data complexity; helped classify sensitive datasets and apply protection measures for subscriber, usage, and billing data."
Pauliina H.
Entertainment, Enterprise
"Effective support for securing customer data"
"Identified where sensitive data lived and applied tokenization and anonymization strategies in a complex telecom environment."
Jordan R.
Computer Networking
"Practical approach to safeguarding e commerce"
"Helped protect PII, payment data, and order histories with tokenization and anonymization; advised on GDPR compliance for international operations."
Charmaine S.
Int. Trade & Development
"Systematic Approach Enhances Data Security"
"Methodical approach through discovery, planning, and implementation; implemented Microsoft Purview for a scalable compliance framework."
Kateryna H.
IT and Services
"Practical approach to protecting sensitive Data"
"Structured data discovery and classification combining technical analysis with finance data privacy expertise; strong masking and tokenization policies."
Snow D.
Market Research
"Practical expertise for telecom information"
"Introduced tokenization and controlled access strategies for subscriber data while still supporting analytics and reporting."
Laura H.
Hospital & Health Care
"Valuable expertise in healthcare protection"
"Strong expertise in healthcare data security; introduced anonymization techniques for safely using patient data in research and reporting."
Find out your PCI DSS status today.
Tell us how you take card payments and we will confirm your SAQ type, your current scope, and what needs doing first to reach PCI DSS v4.0.1 compliance.
Book a PCI DSS Consultation