What cardholder data can be stored?

What cardholder data can be stored?

Credit Card Data: What is Allowed to be Stored Validating entities are permitted to store data classified as Cardholder Data (CHD). This data includes the 16-digit primary account number (PAN), as well as cardholder name, service code, and expiration date.

Which card holder data should not be stored?

In general, no payment card data should ever be stored by a merchant unless it’s necessary to meet the needs of the business. Sensitive data on the magnetic stripe or chip must never be stored.

What can be stored according to PCI DSS?

If required for business purposes, the cardholder’s name, PAN, expiration date, and service code may be stored as long as they are protected in accordance with PCI DSS requirements.

How many PCI DSS controls are there?

12 requirements
The PCI DSS provides guidelines for securely processing, storing or transmitting payment card data. It aims to protect organizations and their customers against payment card fraud and is made up of 12 requirements or control objectives that comprehensively protect the payments ecosystem.

What are the do’s and don’ts of PCI DSS?

PCI DSS Data Storage Do’s and Don’ts Requirement 3 of the Payment Card Industry Data Security Standard (PCI DSS) is to “protect stored cardholder data.” The public expects that merchants and financial institutions will protect payment card data to thwart data theft and prevent unauthorized use.

What are the do’s and Don’s of PCI data storage?

AT A GLANCE. PCI DATA STORAGE. PCI Data Storage Do’s and Don’ts. Requirement 3 of the Payment Card Industry’s Data Security Standard (PCI DSS) is to “protect stored cardholder data.” The public assumes merchants and financial institutions will protect data on payment cards to thwart theft and prevent unauthorized use.

What are the PCI requirements for cardholder data?

If cardholder data is to be stored, PCI compliance requirements state the cardholder data must be rendered unreadable using industry standard techniques. Validating entities are permitted to store data classified as Cardholder Data (CHD).

Can a PCI card be stored after authorization?

Sensitive Authentication Data (SAD) can never be stored after authorization. If cardholder data is to be stored, PCI compliance requirements state the cardholder data must be rendered unreadable using industry standard techniques. Credit Card Data: What is Allowed to be Stored