SAQ D is the final SAQ and applies to any merchants who don’t meet the criteria for other SAQs, as well as all service providers. SAQ D encompasses the full set of over 200 requirements and covers the entirety of the PCI DSS. If you’re a service provider, this is the only SAQ you are eligible to complete.

What is the difference between SAQ A and SAQ D?

SAQ P2PE is for merchants using approved point-to-point encryption (P2PE) devices, with no electronic card data storage. SAQ D for Merchants is for merchants that do not outsource their credit card processing or use a P2PE solution, and may store credit card data electronically.

What do you mean by SAQ?

The PCI DSS self-assessment questionnaires (SAQs) are validation tools intended to assist merchants and service providers report the results of their PCI DSS self-assessment. The different SAQ types are shown in the table below to help you identify which SAQ best applies to your organization.