PCI compliance in Canada: what merchants need to know

PCI compliance in Canada works the same way it does everywhere else: you follow the Payment Card Industry Data Security Standard (PCI DSS), the security rulebook for any business that stores, processes, or transmits card data. There's no separate Canadian edition. The PCI Security Standards Council describes the standard as baseline technical and operational requirements designed to protect payment account data, and the same version, PCI DSS v4.0.1, applies in Toronto and in Texas.

What's different in Canada is the setting around it: Interac Debit on the same terminals, federal privacy law if something goes wrong, and fee rules that govern how your processor bills for PCI programs. This guide covers those pieces and links to our main guide on what PCI compliance is for the full standard rather than repeating it. Everything here is current as of October 2026.

Is PCI compliance different in Canada?

No. The standard, the questionnaires, and the version are the same. PCI DSS v4.0.1 has been the only active version since v4.0 was retired on December 31, 2024, and its future-dated requirements became mandatory on March 31, 2025. A Canadian merchant validates against exactly the same requirements as an American one.

Size doesn't exempt you either. According to PCI SSC, the standard covers every merchant, whatever its size or volume; what varies is whether a small merchant must formally validate, and each payment brand decides that. A food truck in Halifax and a national chain follow the same rules; they just prove it differently.

Here's what stays the same and what's specific to Canada:

Who enforces PCI compliance in Canada?

The card brands do, through your acquirer. Not the federal government, and not PCI SSC itself. PCI SSC's About Us page answers the question of whether it enforces compliance with a plain "No," and says the payment brands and acquirers decide who must comply and validate. It names American Express, Discover, JCB International, Mastercard, and Visa as brands with their own compliance programs.

Visa sorts merchants into levels by annual Visa transactions. On its published table, Level 1 (over 6 million) files a Report on Compliance from a Qualified Security Assessor each year, while Levels 2 and 3 complete a self-assessment questionnaire each year. Visa merged its old Levels 3 and 4 into one Level 3 on April 25, 2024, a change its What To Do If Compromised guide on Visa's Canadian site says doesn't change anyone's existing compliance requirements. Ask your acquirer which level it puts you in.

Which SAQ should a Canadian merchant file?

The same one you'd file in the US, chosen by how card data reaches you, not by province or industry. Our US guide has the full table. Here's the short version with Canadian examples.

1. If you store card numbers electronically anywhere, including email or a spreadsheet, start from SAQ D.
2. If you sell online only through a hosted payment page, a redirect, or payment links, look at SAQ A. If your page embeds the provider's form, PCI SSC now asks you to confirm your site is not susceptible to attacks from scripts.
3. If you key phone orders one at a time into a third-party virtual terminal on a dedicated computer, look at SAQ C-VT.
4. If you take cards in person on standalone, PCI-listed terminals with an IP connection, kept apart from your other systems, look at SAQ B-IP, or the P2PE questionnaire if your terminals are part of a validated point-to-point encryption solution.

Take a café in Toronto with two countertop terminals on their own network and an online gift card page on its provider's hosted checkout. The counter points toward SAQ B-IP and the web page toward SAQ A, so it should ask its acquirer how it wants both channels reported. A contractor in Calgary who takes deposits by phone through a virtual terminal is in a different spot, closer to SAQ C-VT.

How does Interac fit into PCI compliance?

Interac isn't one of the brands PCI SSC lists as running a compliance program, so PCI DSS itself doesn't create an Interac questionnaire. In practice, though, Interac Debit payments run through the same terminal and PIN pad as your Visa and Mastercard sales, so the security work you do for PCI protects them too. Ask your acquirer whether its PCI program covers your Interac acceptance and what it expects from you.

Three points connect Interac to the PCI work you're already doing:

• PINs are never stored. PCI SSC's storage FAQ says full track data, card verification codes and PIN block data may not be kept once a payment is authorized. A chip-and-PIN debit sale should leave nothing sensitive in your systems.
• PIN pads have their own standard. PCI SSC's PIN Transaction Security (PTS) POI standard sets security requirements for the devices that protect cardholder PINs, which is why your provider should supply terminals on PCI SSC's approved list.
• Tampering is the physical risk to watch. PCI DSS asks merchants to keep a list of card-reading devices, inspect them for tampering, and train staff, as PCI SSC's FAQ on Requirement 9.5 sets out. A skimmer on your PIN pad captures debit PINs as readily as credit card data. Our guide to the credit card skimmer shows how to inspect a terminal in under a minute.

Interac Debit also has fraud features of its own. Each payment is approved by the customer's bank or credit union in real time, and contactless payments are held to per-transaction and cumulative spending limits set by the customer's financial institution. Our guide to what Interac is explains how it works and what it costs. Clearo's POS terminals take Interac alongside Visa, Mastercard, Apple Pay, and Google Pay.

What does PCI compliance cost in Canada?

Most of the cost shows up in two places: fees your processor charges for its PCI program, and the cost of any outside help, such as quarterly scans from an approved scanning vendor if your SAQ requires them.

Processor PCI fees vary widely, so check your own statement. Here's an example with made-up numbers. Say a shop pays a $9.95 monthly PCI program fee, which is $119.40 a year. If it misses its annual SAQ and the processor adds a $25 monthly non-compliance fee for eight months, that's another $200, for $319.40 in total. Filing on time would have saved the $200. Our guide to the PCI compliance fee explains what these charges are and which ones to question.

Canada adds a protection here. Under the Code of Conduct for the Payment Card Industry in Canada, in force in its current form since October 30, 2024, your acquirer and its partners must notify you 30 to 60 calendar days before a new or higher fee takes effect, and you can give notice to leave without penalty within 70 calendar days after the change. If a PCI fee appears or jumps without that notice, ask why. Our guide to credit card fees in Canada covers the rest of the Code.

What happens after a card data breach in Canada?

You face two separate sets of rules: the card networks' and Canada's privacy law. They run on different clocks and go to different places.

The privacy obligations come from the Office of the Privacy Commissioner's guidance on mandatory reporting of breaches of security safeguards, which says organizations must report breaches that pose a real risk of significant harm, notify the people affected, and keep records of all breaches. The OPC also offers an online form to report a privacy breach at your business.

Visa's rules carry one more point worth remembering: assessments may be waived if a forensic investigation finds no evidence of PCI DSS non-compliance before and at the time of the breach. Being current when something goes wrong is the best protection you can buy, and it costs you a questionnaire.

A PCI checklist for Canadian merchants

1. Find out which acquirer is behind your merchant account and how it collects your SAQ.
2. Map every way card data reaches you: terminals, website, phone orders, email, paper.
3. Remove anything you don't need, especially stored card numbers and written-down security codes. Our CVV guide explains why the code can never be kept.
4. Choose your SAQ, answer it honestly, and sign the attestation.
5. Book quarterly scans if your SAQ requires them.
6. Keep a device list for every terminal and PIN pad, and inspect them on a schedule.
7. Save stored cards as tokens from your provider rather than numbers. Our guide to payment tokenization shows how.
8. Write down who you'd call in a breach: your provider, Visa through your acquirer, and the OPC.
9. Check your statement for PCI fees and any notice of new ones.

Is paying for extra PCI help worth it?

For most small Canadian merchants, no. A merchant under 1 million Visa transactions a year files a questionnaire, not an on-site audit, and the cheapest way to make that questionnaire short is to keep card data off your own systems. Hosted checkout online, standalone or P2PE terminals in store, and tokens for repeat customers do more than any consultant's report. Our page on how checkout and terminals shrink PCI scope shows how each choice shortens the questionnaire.

Paying for help makes sense when your setup is genuinely complicated: you store card data, run your own payment page, or operate several locations on shared systems. A retailer with stores in Montreal and Ottawa on one integrated POS system has more to document than a single shop with one terminal. Our Canada locations hub covers provincial payment rules, and Clearo's online payments include hosted checkout.

Next step

If you're not sure which SAQ fits, or there's a PCI charge on your statement you can't explain, send us a recent statement for a free statement review. We'll point out the PCI-related fees and what your setup likely requires. Clearo offers PCI compliance support, and if you'd rather talk it through first, contact us.