Our most popular products, like Website Payments Standard, Express Checkout and Invoicing, are already PCI compliant. And, because we handle your customers’ card information for you, you can forget about the time, cost and headache of maintaining PCI compliance.
So by PayPal's wording there, you don't need to do anything if you are not handling cardholder data that includes at least the
PAN -- Primary Account Number -- for a card.
In the first instance, fines for non-compliance are levied on payment providers and large merchants, so if PayPal was in line for a huge fine, they would have been ensuring every merchant using their services would be filling out their self-assessment questionnaire (SAQ), since PayPal would be responsible for ensuring that inputs into their systems are also compliant.
Even the simplest
SAQ-A self-assessment would be beyond most sole traders to reliably complete themselves, just because it has too many technical considerations that they would have no idea about.
From this diagram (https://www.pcicomplianceguide.org/wp-content/uploads/2016/01/SAQ-3-1-Ecommerce-Options-Explained-Examples-ControlScan.pdf), even having a product page -- regardless of whether it collects cardholder data -- seems to imply that the
SAQ-A-EP needs to be used. However,
Generally, I find the PCI documentation rather obtuse and an over-reach since they continually refer to cardholder data as their principal criteria, but seem to want to control every system that feeds into their process, regardless of whether the PAN is included or not. Providing the information means that your personal details, and the detailed configuration of your systems, is being provided to one or more third parties, whose own systems and processes you are expected to trust.
The PCI documentation refers to the situation
even if you don't store cardholder data, but don't separately explicitly cover the situation where your systems do not handle any cardholder data, that is, don't even collect or transmit it. Note that data only becomes
cardholder data when it includes the PAN, otherwise it is just customer data that you might hold regardless of whether you took credit card payments, and while having good data handling security of that customer data is good, it should be none of the card companies' business if it does not include the PAN.
Note that, technically,
IPN do not return
cardholder data, as they do not include the
PAN with the customer and transaction details returned.