1

We do not store PAN card data, but we do store other non-PAN data such as expiration date, billing zip, and cardholder name. We store this info for use with card-on-file tokens provided by our payment processor. Do we need to encrypt this non-PAN data in our database without the PAN?

We expect to qualify for PCI-SAQ D under PCI DSS 3.2.1.

Improve this question

1 Answer 1

Reset to default
3

Do we need to encrypt this non-PAN data in our database without the PAN?

No. To quote the DSS, "If PAN is stored with other elements of cardholder data, only the PAN must be rendered unreadable according to PCI DSS Requirement 3.4." We can assume that when stored with tokens or other non-PAN data, this non-requirement stands, because "[PAN] is the defining factor for cardholder data."

The first quote is from page 8, which also has a nifty table showing what must be rendered unreadable:

Data Encryption Table from PCI DSS 3.2.1

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .