What is SAQ A? The shortest PCI DSS self-assessment explained

SAQ A is the shortest of the PCI DSS Self-Assessment Questionnaires. It is meant for card-not-present merchants (e-commerce or mail and telephone order) whose account data functions are completely outsourced to PCI DSS validated and compliant third parties, and who do not store, process or transmit any account data in electronic form on their own systems or premises.

How SAQ A works

PCI DSS, the Payment Card Industry Data Security Standard, sets security requirements for businesses that accept payment cards. Many merchants show they meet it by completing a self-assessment questionnaire (SAQ) instead of a full on-site assessment. The PCI Security Standards Council (PCI SSC) publishes several SAQs, including A, A-EP, B, B-IP, C, C-VT and D, each written for a different way of accepting cards. The more of the card data flow a merchant controls, the more requirements its questionnaire contains.

SAQ A sits at the light end because the merchant's own systems never handle card numbers. In an online store, this usually means the payment form is provided entirely by the payment provider, so shoppers enter their card details into the provider's page or form rather than into the store's own code. Under SAQ A, a merchant may keep paper reports or receipts that contain account data, but nothing electronic.

What changed in 2025

PCI DSS v4.0.1 includes two payment page security requirements, 6.4.3 and 11.6.1, that became effective on 31 March 2025. In January 2025 the PCI SSC published a revised SAQ A that removes those two requirements, plus the related targeted risk analysis in requirement 12.3.1, from the questionnaire. In exchange, it adds an eligibility criterion: merchants must confirm their site is “not susceptible to attacks from scripts that could affect the merchant's e-commerce system(s).” The revised version took effect on 31 March 2025, when the October 2024 version was retired.

Why it matters for an online store

A checkout that keeps card data entirely off your systems shrinks the part of your business that PCI DSS reaches, which is why so many stores aim for SAQ A. It does not make security someone else's problem. The PCI SSC stresses that the 2025 changes “do not remove or diminish the underlying requirements within PCI DSS,” and you still have to complete the questionnaire truthfully.

Common mistakes

  • Assuming SAQ A applies automatically. The PCI SSC does not decide who must validate or which SAQ they may use. Card brands, acquirers and payment facilitators set those rules, so confirm with yours.
  • Mixing payment flows. If any page or server of yours receives card numbers, for example a custom form that posts to your own backend, you are no longer fully outsourced, and a different SAQ such as A-EP or D may apply.
  • Ignoring scripts on the site. Under the current version you must be able to confirm that your site is not susceptible to script attacks that could affect your e-commerce systems.

Related terms

This page is general information, not legal or compliance advice.

Sources