The organization I work for hold PCI-DSS compliance as merchants (we fill in SAQ-D). At the same time, due to document/payment verification processes, we request from our customers pictures of their credit/debit cards - of course with the appropriate digits hidden.
Now we want to outsource this functionality to another company which will only be responsible for the document verification and will send back to us the picture of the card and the data on the card - again the ones that can be viewed according to PCI (ocr recognition):
- Expiration/Issuing Date
- First six PAN number digits
- Last 4 PAN number digits
- Cardholder's name
We have signed a DPA with them and agreed on that in case they receive an unmasked card, they will immidiatelly reject it and inform us so we can get in touch with the customer inform accordingly. All this communication will be done over an encrypted communication channel
They are not a payment service provider, they will just provide a mechanism for documents verification (one of these documents are masked credit/debit cards).
So my question is, can we do that according to the PCI?