Protect Account Data
3
Protect Stored Account Data
Stored account data must be protected through encryption, truncation, masking, or hashing. Sensitive authentication data (full track data, CVV, PIN) must never be stored after authorisation. This requirement establishes strict rules on what data can be retained, how long, and what protection mechanisms must be applied.
Control Intent
Minimise the storage of account data and protect any data that must be retained using strong cryptographic controls, ensuring sensitive authentication data is never stored post-authorisation.
Common Failures
- Storing full track data, CVV2/CVC2 values, or PINs after authorisation in databases or log files
- Failing to implement data retention limits, keeping cardholder data indefinitely across backup systems
- Displaying full PAN in application interfaces, reports, or receipts without masking
- Using weak or deprecated encryption algorithms (e.g., DES, MD5) to protect stored PAN
- Poor key management — encryption keys stored alongside encrypted data or not rotated per policy