PCI-DSS self-assessment
Your annual PCI-DSS Self-Assessment Questionnaire, submitted through your card processor or acquirer, confirming how you take card payments and that you are handling cardholder data securely — most hospitality venues qualify for the shortest questionnaire if they use a standalone terminal that never touches your own systems.
Your annual PCI-DSS Self-Assessment Questionnaire, submitted through your card processor or acquirer, confirming how you take card payments and that you are handling cardholder data securely — most hospitality venues qualify for the shortest questionnaire if they use a standalone terminal that never touches your own systems.
Card processors require a valid attestation on file and can apply non-compliance fees, or in a serious case restrict your ability to take card payments, if it lapses. It also matters if you ever have a card data breach — being able to show a current attestation affects how liability is handled.
Who this is for
Every venue that takes card payments.
What you’ll hold
- Completed Self-Assessment Questionnaire (SAQ)
- Attestation of Compliance
Watch out for
- Ignoring the processor's email as spam or marketing, then finding a non-compliance fee added to a later statement.
- Picking the wrong SAQ type — using a full network-facing questionnaire when a standalone terminal qualifies for the short form.
- Assuming a new terminal or processor carries over last year's attestation — a change of provider usually means starting the SAQ again.
Sources
- PCI Security Standards Council checked 2026-09-02
See also
- Set up card payments, EPOS and your first PCI self-assessment— this becomes part of getting open →
This is item 43 of 60 in the free UK Compliance Calendar. See the whole list →