I have a question regarding PCI compliance. There seems to be a valid business need in our company to keep some card holder data, for unsuccessful transaction. An example would be a customer makes a hotel booking but the payment fails then a support agent can retry the payment using the card holder data, this forms part of our service. But we do not want to store any cardholder data digitally. In this case we want to print the card holder data for later use and destroy the paper safely within 3 days. There will be no storing digitally of the card data on their systems. Making it more easy for us to comply with the PCI requirements.
Is the above allowed under PCI regulation? I believe you can do that so long as the physical security is in place and only users with a legitimate business need has access. What would be the correct why to do this?