If your store accepts credit or debit cards, you are expected to follow the Payment Card Industry Data Security Standard, usually shortened to PCI DSS. It sounds like a big-company concern, but it applies to a one-register shop as much as a chain. The good news is that the right payment setup can shrink your part of the work considerably. This article explains PCI compliance for small retailers in plain language. It is general information, not legal or compliance advice, so check your obligations with your payment provider or a qualified assessor.
What PCI is, in one paragraph
PCI DSS is a set of security requirements created by the major card brands to protect cardholder data. Businesses that accept cards are expected to meet them, and the amount of work depends on how you handle card data. Your payment processor usually tells you what to complete, often a self-assessment questionnaire each year, and may charge a fee if you do not. The less card data touches your own systems, the shorter that questionnaire tends to be.
Why your setup matters more than your size
There is a big difference between a store that types card numbers into a computer and one that taps a certified card reader. In the second case, the reader captures the card details and passes them to the payment provider, and your own POS software never sees the full number. That is generally the lower-risk way to take cards in a store, and it is why most modern systems pair with readers rather than asking you to key numbers into a screen.
Retailer OS takes card payments through Stripe, on your own Stripe account, using Stripe Terminal card readers in the store. Card details are handled by the reader and Stripe. Using a reader that is built for this purpose is one of the simplest steps toward a smaller compliance burden. It does not remove your responsibility, which we cover below.
What stays your responsibility
Even with a secure reader, you still have work to do:
- Complete the questionnaire. Your processor will ask you to confirm how you accept cards and attest to your security practices, typically once a year.
- Protect the devices. Keep operating systems and apps updated, use strong passwords and lock screens, and use antivirus where it applies.
- Control who has access. Give each staff member their own login and only the permissions they need. See roles and permissions.
- Secure your network. Keep the store Wi-Fi password private, separate guest Wi-Fi from the one used for payments, and change default router passwords.
- Inspect your readers. Check card readers regularly for tampering and keep a list of devices and where they are.
- Do not write card numbers down. Never store full numbers on paper, in spreadsheets, in email or in photos.
Practical habits that help
One login per person
Shared logins make it impossible to know who did what. Individual accounts let you remove a person the day they leave and keep an audit trail for refunds and voids.
Limit refunds and overrides
Many card-related losses come from refunds issued to the wrong card or by the wrong person, rather than from hackers. Restrict refunds and price overrides to managers, and review them regularly.
Keep a simple security checklist
Write down who updates devices, who changes passwords when staff leave, and who checks readers. A single page taped inside the back office is enough to start, as long as someone owns it.
Questions to ask your payment provider
- Which PCI questionnaire applies to my setup?
- Is there a fee for non-compliance, and how do I avoid it?
- Are the readers I plan to use certified and supported?
- What happens if there is a suspected breach?
- How do I get a copy of my compliance status?
For fees and how processors price card payments, see our explainer on credit card processing fees. If you are weighing systems, the question to ask any vendor is who handles card data and what they will ask you to do.
Offline and online sales
Different channels carry different considerations. In-store reader payments are the simplest case. If you add an online store or marketplace channels, card data should be collected through the provider’s hosted payment fields rather than your own forms. Retailer OS offers an online store as an optional add-on at $99.99 a month, billed once per account, and Amazon and eBay at $99.99 a month each. Selling offline is supported in the desktop app only, so check how card payments behave when the connection is down before relying on it.
If something goes wrong
Have a plan before you need one. Know whom to call at your payment provider, how to disable a lost or stolen device, and how to change credentials quickly. After any suspected incident, contact your provider first and follow its instructions. Acting fast limits the damage and shows good faith.
Common myths
- "I am too small for PCI to matter." The requirements apply to any business that accepts cards, and small shops are frequent targets because they are assumed to be less careful.
- "My POS vendor handles all of it." A good vendor and processor reduce your exposure, but you still attest to your own practices and protect your own devices and network.
- "Compliance is a one-time task." It is an annual cycle, and your answers need to stay true all year.
- "Only the card reader matters." The laptop, tablet, router and staff habits around it matter too.
Setting up a store the safe way
When you open or refit a store, build security into the layout and the setup. Place the reader where staff can see it and customers can reach it without being able to pull it from the counter. Mount or tether it if the model allows. Keep back-office computers off the customer Wi-Fi, and do not let the same machine that runs the register browse the open internet for personal use. Create each staff account before opening day, assign roles, and decide who can reset passwords. A few hours spent on this before launch is cheaper than a clean-up afterwards.
Keeping records
Save a copy of each year’s completed questionnaire, any scan reports your provider requires, your device list and your staff access list. If a dispute, audit or incident ever comes up, being able to show what you did and when is far better than reconstructing it from memory. A dated folder in your cloud storage, with a short note on who is responsible for each item, is enough for most small stores.
The short version
- PCI applies to every business that accepts cards, whatever its size.
- A certified reader and a trusted payment provider reduce what you handle.
- You still own the questionnaire, device security, access control and staff habits.
- Keep a one-page routine and review it every few months.
If you are comparing systems, our buyer’s guide and the decision worksheet include payment questions worth asking. You can also read the retail POS system overview, or start a 14-day free trial with no card and see how payments are set up before you commit. Pricing is $99.99 per store and $9.99 per user seat monthly, from $109.98.
Last updated October 5, 2026