Platform guide
PayPal PCI compliance: how your checkout choice changes the work
PayPal PCI compliance depends on how you add PayPal to your site. Hosted buttons and PayPal-served card fields keep card data away from your servers, while handling card numbers yourself brings your systems into scope.
- Not a QSA, stated first
- Introductions to independent QSAs
- Written answers, no call
What PayPal covers in PayPal PCI compliance
When customers pay through PayPal's hosted experience, PayPal handles the card data. Therefore much of the burden sits with PayPal. Check PayPal's own documentation for its current compliance statement. The standard is in the PCI SSC document library.
How integration changes PayPal PCI compliance
Different PayPal products have different effects.
| Integration | Typical effect |
|---|---|
| PayPal buttons and hosted checkout | Card data stays with PayPal, often SAQ A. |
| PayPal-served card fields | Often SAQ A, if fields come entirely from PayPal. |
| Your server handles card numbers | Usually SAQ D. |
PayPal PCI compliance check
Tick each statement that is true.
Your result appears here as you tick, so you can see what is still open.
What you still own in PayPal PCI compliance
Some duties remain with you. So review them each year.
- Completing the questionnaire your acquirer asks for
- Keeping your website secure and unaltered
- Not collecting card data by email or phone
- Protecting accounts with access to PayPal
Common PayPal PCI compliance mistakes
Merchants sometimes add scripts near checkout without review, or keep card details from customer emails. Each one can move you outside the simplest form. Therefore review side channels and scripts before answering.
A simple rule helps: card details only ever go through PayPal's own fields. Then staff know to redirect any customer who tries to send them another way.
Where we help
We review your integration and confirm the form. However, we are not a QSA, and we are not affiliated with PayPal.
Also keep PayPal's current compliance statement with your records. Your acquirer may ask how you confirmed your provider's status, and a dated copy answers that at once.
PayPal PCI compliance questions
Does PayPal PCI compliance mean we have nothing to do?
No. PayPal covers its systems, but you still confirm your own practices.
Which SAQ applies with PayPal?
Often SAQ A for hosted options, but SAQ D if you handle card numbers.
Do card fields keep PayPal PCI compliance simple?
Often, if the fields are served entirely by PayPal, but confirm with your acquirer.
Are you affiliated with PayPal?
No. We are independent.
Related guides
Check your PayPal integration
Describe how PayPal is added to your site. We reply in writing with the likely form and any gaps.
Ask us anything