Retail IT & Security

Card data brings obligations that do not scale down

Any business accepting card payments falls under PCI DSS. The validation requirements scale with volume, but the security requirements largely do not — a single-location shop still has to protect cardholder data properly.

The most effective move for most small retailers is to reduce scope rather than secure more: point-to-point encryption and tokenisation mean card data never lands in your systems in a form worth stealing, which shrinks both the risk and the compliance burden.

What we address

• Point-of-sale system security and separation from general business and guest networks
• Guest Wi-Fi isolated from anything touching payments or business systems
• Customer data handling under California privacy law, including retention and deletion
• Consistent device management and patching across locations through Intune
• Backup and recovery for systems that would stop you trading

Related services

See cybersecurity services, managed IT and compliance services.

Frequently asked questions

Does PCI DSS apply to a small retailer?

Yes. Any business accepting card payments is subject to PCI DSS; what scales with transaction volume is the validation requirement, not the underlying security obligation. The practical route for small retailers is scope reduction through point-to-point encryption and tokenisation.

Is our guest Wi-Fi a risk?

It is if it shares a network with point-of-sale or business systems. Guest access should be fully isolated. This is a configuration issue rather than a hardware purchase in most retail setups.

What are our obligations for customer data in California?

California's breach notification statutes apply to personal information you hold, and CCPA obligations may apply depending on your revenue and data volume thresholds. The practical questions are what you collect, how long you keep it, and whether you can delete it on request.