We are looking at becoming PCI-DSS complaint. We wish to minimize the impact it will have on us and our business. As this can be a very expensive exercise. As I understand it if you do not store cardholder data that decrease risk.

My question is if we store only the BIN part of the PAN does this qualify as cardholder data? We wish to store the BIN in combination with the Cardholder Name.

Any clarification would be greatly appreciated.


Storing only the BIN part of the PAN does not qualify as a full PAN. When you are thinking about PAN storage, you have to consider Requirement 3: Protect Stored carholder data. Your question is answered by requirement 3.4 (this is an extract of the navigating PCI-DSS document):

3.4 Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on strong cryptography (hash must be of the entire PAN), Truncation (hashing cannot be used to replace the truncated segment of PAN), Index tokens and pads (pads must be securely stored), Strong cryptography with associated key-management processes and procedures

What you are trying to do is referred as "Truncation", limited to the first six digits:

The intent of truncation is that only a portion (not to exceed the first six and last four digits) of the PAN is stored.

  • Hi Gael. Thank you for the answer. My question then is if I truncate the PAN to first 6 digits. Totally discarding the rest in memory. Do I still need to comply with section 3.4?
    – Rup
    Jul 26 '12 at 9:47
  • Not sure I fully understand the question. First of all, let me clarify that requirement 3.4 is only about persistent storage. If you only store the PAN in RAM, you don't have to comply with 3.4 (truncated or not). If you are storing the PAN on disk, you have to comply with 3.4. One way of doing so is by truncation. Jul 26 '12 at 9:59
  • Thank you. That clears it up for me. Even if truncated if stored on disk 3.4 will apply.
    – Rup
    Jul 26 '12 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.