3

I have a question regarding PCI compliance. There seems to be a valid business need in our company to keep some card holder data, for unsuccessful transaction. An example would be a customer makes a hotel booking but the payment fails then a support agent can retry the payment using the card holder data, this forms part of our service. But we do not want to store any cardholder data digitally. In this case we want to print the card holder data for later use and destroy the paper safely within 3 days. There will be no storing digitally of the card data on their systems. Making it more easy for us to comply with the PCI requirements.

Is the above allowed under PCI regulation? I believe you can do that so long as the physical security is in place and only users with a legitimate business need has access. What would be the correct why to do this?

Improve this question

2 Answers 2

Reset to default
5

It would only be allowed if you are compliant in other areas.

PCI DSS doesn't just cover digital storage of data, but also the transmission, physical storage and destruction of data.

  1. How does the agent get the card holder data?
  2. How is the data go to your printer?
  3. How and where is the data stored for three days?
  4. How is the data destroyed?
Improve this answer
3

If you print full cardholder data, you must adhere to the PCI-DSS for those printouts, including physical protection. From the PCI Compliance Guide FAQs:

PCI DSS requirement 3.3 states "Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).” While the requirement does not prohibit printing of the full card number or expiry date on receipts (either the merchant copy or the consumer copy), please note that PCI DSS does not override any other laws that legislate what can be printed on receipts (such as the U.S. Fair and Accurate Credit Transactions Act (FACTA) or any other applicable laws). See the italicized note under PCI DSS requirement 3.3 “Note: This requirement does not apply to employees and other parties with a specific need to see the full PAN, nor does the requirement supersede stricter requirements in place for displays of cardholder data (for example, for point of sale (POS) receipts).” Any paper receipts stored by merchants must adhere to the PCI DSS, especially requirement 9 regarding physical security.

Keep in mind that you're pretty much never allowed to store the CVV, so don't even think about printing that.

If I were you I would be concerned about the proper destruction of printed data. It's hard to do right, and it's really hard to do right over a long period of time.

A more technical solution would be to encrypt the data using a public key, and escrow the private key half of the pair on a separate system (airgapped if possible). The nice thing about encryption is that it means your data is already "shredded" if someone gets a hold of it. Yes, it'll cost you more up front for development costs. You'll probably earn it back in a year of printing and shredding bills, though.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .