Cardholder Data Storage

Cardholder data storage refers to whether, and how, a merchant or service provider keeps card numbers and related details after a payment. Under the PCI DSS, cardholder data means the primary account number, plus the cardholder name, expiry date and service code when stored with it. Storage should be limited to what is needed for a business purpose and kept only for a defined retention period. Any stored PAN must be rendered unreadable, for example by encryption, truncation, strong one-way hashing or replacement with a token. Sensitive authentication data, including full magnetic-stripe or chip data, the card security code and PINs, must not be stored after authorisation, even in encrypted form, apart from limited exceptions for issuers. Many merchants avoid storage altogether by using gateway or network tokens, which shrinks their cardholder data environment. Also see data security.