An online store handles two kinds of sensitive data with very different rules. Card data is governed by contract: your acquirer requires PCI DSS, and the card brands set the consequences. Everything else you know about shoppers, including names, addresses, order histories, and the tracking data your marketing stack collects, is governed by privacy law. The cheapest way to handle the first is to keep card data off your systems entirely. The second cannot be outsourced away, only managed.
The obligations in one view
Choosing the right PCI DSS self-assessment questionnaire
The SAQ you complete is determined by how card data moves, and your acquirer confirms which applies. Small design choices in checkout move you between types, and the difference in effort is large. SAQ D contains every applicable requirement, while SAQ A is a small fraction of that. The summary below is a high-level guide; read the eligibility criteria in the current SAQ before relying on it. Our PCI DSS glossary entry covers the core terms.
Payment page scripts
PCI DSS v4 introduced two requirements aimed at skimming attacks on checkout pages, both mandatory since 31 March 2025. Requirement 6.4.3 asks you to inventory every script executed on payment pages, justify why each is needed, and confirm each is authorized and its integrity assured. Requirement 11.6.1 asks for a mechanism that detects unauthorized changes to payment page content and security headers as the browser receives them. The SAQ A eligibility criteria were revised in 2025 to address how these apply to fully outsourced checkouts, so confirm the current wording with your acquirer.
Partners who share your scope
- A list of every third-party service provider that handles card data or can affect its security, such as payment gateways, hosting, and managed checkout
- A current attestation of compliance from each, checked at least annually
- A written responsibility matrix showing which PCI DSS requirements the provider manages, which you manage, and which are shared
- Data processing agreements with marketing, analytics, customer support, and email platforms that receive shopper data
- Access reviews for third-party logistics and fulfillment partners that see order and address data
- Tiering so the payment provider and platform host get deeper review than a packaging supplier, using a model like our vendor tiering template
A sequencing plan for retailers
- Redesign checkout for minimum scope before documenting anything, then confirm the SAQ with your acquirer. See PCI DSS compliance.
- Map customer data flows, including every tag and pixel on the site and every platform receiving order data.
- Fix consent and opt-out handling so tags respect choices, and stand up a process for access and deletion requests under GDPR and CCPA/CPRA.
- Put script monitoring on payment pages and tie alerts to someone who can act on them.
- Consider ISO 27001 once B2B partners, marketplaces, or wholesale customers start asking for formal assurance.
Pitfalls, and how to keep it running
- Adding a marketing script to checkout that silently changes your SAQ eligibility or your 6.4.3 inventory.
- Recording card numbers in call recordings, support tickets, or order notes, which pulls those systems into scope.
- Treating the annual SAQ as a form to sign rather than a check that the controls still match the site.
- Firing advertising pixels before consent in regions that require it.
Asurvo supports PCI DSS 4.0.1, GDPR, CCPA/CPRA, and ISO 27001 with automated cross-mapping, so a control like access review is evidenced once. The Third Party module keeps partner inventory, tiering, questionnaires, and risk scoring in one place, and evidence expiry tracking flags an attestation or review before it lapses.