Small companies and PCI compliance
Here is an interesting article on one possible way in which companies can be PCI compliant; just don’t ever store, process, or transmit cardholder data - let someone else do it for you. This is because PCI only applies to you if you store, process, or transmit cardholder data.
December 7th, 2008 at 5:50 pm
Beware, if someone else (your third-party vendor) is using your Merchant ID then you may hold responsibility for the transactions and their loss. If this is the case, you may also have a PCI obligation. Check out the Self-Assessment Questionnaire A if you outsource e-commerce transactions, just to be safe.