I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment processing company I'll be working with. I've read up on the PCI DSS requirements about storing card data which seems straight forward. However, while reading up on the subject I ran across this footnote:
These data elements must be protected if stored in conjunction with the PAN. This protection should be per PCI DSS requirements for general protection of the cardholder data environment. Additionally, other legislation (e.g., related to consumer personal data protection, privacy, identity theft, or data security) may require specific protection of this data, or proper disclosure of a company’s practices if consumer-related personal data is being collected during the course of business. PCI DSS, however, does not apply if PANs are not stored, processed, or transmitted.
If I understand this section, specifically the last sentence about transmitting full PANs, I will need to protect the other data elements (such as CVV, expiry, etc.) since I will be transmitting the PAN. What I'm struggling with is: How do I protect those values? Is transmitting the data elements via secure HTTP connections satisfactory? Or are there other measures I would need to take with this scenario?