If you take card payments, you fall under PCI DSS, the card industry's security rules, and you evidence it with a self-assessment questionnaire, an SAQ. Which questionnaire you complete depends entirely on how you take the money, and the gap between the easy one and the hard one is enormous. Most small firms have no idea they get to choose, or that a single habit pushes them into the difficult version.

If you only ever take payment through a modern card machine or a hosted online checkout, you are on the short questionnaire - a couple of dozen questions, most of which your terminal provider already satisfies for you. The moment you start taking card numbers read out over the phone and typed into anything, you move onto a far longer questionnaire, because now the card data is passing through your own phone line, your own staff and your own systems.

That is where the twelvefold jump comes from. It is not a penalty. It is simply that once you are handling the raw card number yourself, the rules quite reasonably ask you to prove a great deal more about your call recording, your systems and your staff, all of which touch that number. The paperwork balloons because the actual risk has ballooned, and pretending otherwise on the form is how firms end up non-compliant without realising.

The good news is that the fix is a workflow change, not a purchase. Stop typing card numbers yourself. Send the customer a secure payment link, use a “pay by link” feature from your provider, or a phone-payment service that keeps the number away from your staff entirely. Do that and you drop back to the short questionnaire, your staff stop being the risky part, and the paperwork you did not want simply does not apply.