Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website?
For example: If a business or charity operated their webpage with a PayPal standard donate button on it for donation with a linking to PayPal accepting credit cards, does their webpage have to be PCI-DSS compliant or not?
I am confused but whether or not falls under SAQ-A, where it defines URL link redirects.
VISA doesn't seem to include this scenario in their PCI-DSS guide: https://www.visaeurope.com/media/images/processing%20e-commerce%20payments%20guide-73-17337.pdf
If having links requires PCI-DSS compliance, this is quite prohibitive for some charity organizations I know - hosting and maintaining a website which is PCI-DSS compliant may be too complex and costly for them to upkeep.
As a side-note, if a the presence of a credit card accepting PayPal button means the merchant website has to be PCI-DSS compliant, placing a link on a merchant's own site may not be any less secure than sharing it on social media (Facebook, Twitter) or other sharing platforms (Twitch, bulletin boards/forums)? Does this affect direct URL links to a PayPal credit card payment page from a merchant's social media page?
My lesson to be learned may be to be more careful with credit card payment forms.
I have checked other similar questions but they do not address the use of the PayPal buttons. A similar situation would be using Razoo.
Edit: After some more reading, the merchant needs to pay attention to PCI-DSS compliance. The practical starting point for self-assessment would still be SAQ A for all intents and purposes. PayPal's public documentation is lacking, but I've found some recommendations from Recurly: https://docs.recurly.com/pci-dss-compliance
A merchant must always be PCI compliant if they accept credit card payments online (even if the card is entered on another site). If using HPP, Recurly’s recommendation is to complete SAQ A. (HPP - hosted payment pages)