1

We do not store PAN card data, but we do store other non-PAN data such as expiration date, billing zip, and cardholder name. We store this info for use with card-on-file tokens provided by our payment processor. Do we need to encrypt this non-PAN data in our database without the PAN?

We expect to qualify for PCI-SAQ D under PCI DSS 3.2.1.

3

Do we need to encrypt this non-PAN data in our database without the PAN?

No. To quote the DSS, "If PAN is stored with other elements of cardholder data, only the PAN must be rendered unreadable according to PCI DSS Requirement 3.4." We can assume that when stored with tokens or other non-PAN data, this non-requirement stands, because "[PAN] is the defining factor for cardholder data."

The first quote is from page 8, which also has a nifty table showing what must be rendered unreadable:

Data Encryption Table from PCI DSS 3.2.1

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.