Payment Card Data

Payment card data is the information used to identify a payment card and to authorise and authenticate transactions made with it. Under the Payment Card Industry Data Security Standard (PCI DSS), it falls into two groups. Cardholder data includes the primary account number, or card number, together with the cardholder's name, the expiry date and the service code. Sensitive authentication data includes the full magnetic stripe or chip data, card verification codes and PINs or PIN blocks. Cardholder data may be stored if it is protected, for example by encryption, truncation or tokenisation, but sensitive authentication data must not be kept after authorisation, even in encrypted form. Any system that stores, processes or transmits card data forms part of the cardholder data environment and falls within PCI DSS. Many merchants reduce their exposure by using hosted payment pages and payment tokenization, so that card data never touches their own systems.