PCI DSS SAQ A vs SAQ D: Which Questionnaire Applies to You

SAQ A or SAQ D: which PCI questionnaire applies to you?

SAQ A applies if you never touch card data yourself: every card number is entered, transmitted, processed and stored by a PCI DSS compliant third party, and your systems only ever see a token or a confirmation. SAQ D applies if any of that happens on systems you own or control, or if you fit none of the other questionnaires. Most small merchants are one of the two, and the gap between them is where scope reduction pays.

The PCI Security Standards Council publishes each SAQ and its instructions in its document library. Your acquirer tells you which one to file and when.

What SAQ A covers

It is the shortest questionnaire and the one with the strictest entry conditions. Under PCI DSS v4.x, a merchant is eligible broadly when:

• Card transactions are card-not-present only (e-commerce or mail and telephone order).
• All processing of account data is entirely outsourced to PCI DSS compliant third-party service providers.
• The merchant does not electronically store, process or transmit any account data on its own systems or premises, and relies entirely on those third parties to do so.
• Any account data the merchant keeps is on paper, such as printed reports or receipts, and is not received electronically.
• For e-commerce, every element of the payment page delivered to the customer's browser originates only from the compliant third party (a full redirect or a hosted iframe), and, following the PCI SSC's January 2025 revision, the merchant's site is confirmed not to be susceptible to script attacks that could affect the payment page.

Typical SAQ A merchants: an online shop that redirects to a hosted checkout, a consultancy that invoices through a payment platform's hosted page, a clinic that takes phone payments on the processor's own terminal.

What SAQ D covers

This is the long form. It covers every PCI DSS requirement that applies to your environment, because your environment is in scope. You are an SAQ D merchant if:

• Your website's own server collects card numbers before passing them to a processor.
• You store card data electronically for recurring billing or refunds.
• Card data crosses your network: a point-of-sale system that is not a validated P2PE solution, or a virtual terminal on a shared office PC.
• You do not meet the eligibility criteria of SAQ A, A-EP, B, B-IP, C, C-VT or P2PE.

The work behind SAQ D is the work of PCI DSS itself: segmentation, firewall rules, logging, patching, scanning, access control, encryption of stored data, policies, training and an annual risk assessment. File it honestly and you have run a security program. File it dishonestly and you have signed an attestation that will be read after the breach.

Side by side

	SAQ A	SAQ D (merchant)
Who	Card-not-present merchants with everything outsourced	Everyone who fits no shorter SAQ
What is in scope	The merchant account, the redirect page, the third-party list	Every system that stores, processes or transmits card data, and anything connected to it
Length	A short subset of requirements	All applicable requirements
Vulnerability scanning	Possibly, depending on acquirer and setup	Quarterly ASV scans of internet-facing systems, plus internal scanning
Who signs	You (and the acquirer accepts it)	You, unless your volume puts you at Level 1 and the card brands require a QSA

What each costs

The questionnaire is cheap; the environment behind it is not. According to SecurityMetrics, a QSA firm, in a page updated 4 June 2026, a small business's PCI compliance can start "from $300 per year", with the "Self-Assessment Questionnaire: $50 - $200" and "Vulnerability scanning: around $100 - $200 per IP address". The same page puts a QSA assessment at "on average around $15,000" and large enterprise programs at "$70,000+". An SAQ D merchant pays for the scanning, the segmentation work and the time; an SAQ A merchant pays for almost none of it.

Moving from D to A

Most small merchants on SAQ D are there by accident: a web developer put a card form on the site, or a receptionist keeps cards in a spreadsheet for repeat patients. The fix is to push every card touch to the processor. Replace the embedded form with a hosted page or iframe. Use the processor's card-on-file vault for repeat billing. Take phone payments on the processor's terminal, not a desktop. PCI scope reduction walks through each change, and PCI DSS 4.0.1 for small business covers the current version's requirements for what stays in scope.

Then confirm the new state with your acquirer and file the shorter SAQ. The attestation is easy once the card data has left the building.

Where AccuSights fits

We map where card data actually flows, help you move it out of your environment, prepare the SAQ you are eligible for and run the scans, with a named engineer rather than a ticket queue and remediation included. We are not a QSA and do not issue a Report on Compliance; we prepare you for your acquirer. Start with the PCI framework page or book a free Risk Diagnosis and we will tell you which SAQ you are today and which one you could be.