PCI DSS Protectecting Card Data Elements when Transmitting PAN

Question

I'm currently working on a mobile application that will need to transmit a customers full card data to an internal API that will then transmit the information to an external API owned by a payment processing company I'll be working with. I've read up on the PCI DSS requirements about storing card data which seems straight forward. However, while reading up on the subject I ran across this footnote:

These data elements must be protected if stored in conjunction with the PAN. This protection should be per PCI DSS requirements for general protection of the cardholder data environment. Additionally, other legislation (e.g., related to consumer personal data protection, privacy, identity theft, or data security) may require specific protection of this data, or proper disclosure of a company’s practices if consumer-related personal data is being collected during the course of business. PCI DSS, however, does not apply if PANs are not stored, processed, or transmitted.

Source

If I understand this section, specifically the last sentence about transmitting full PANs, I will need to protect the other data elements (such as CVV, expiry, etc.) since I will be transmitting the PAN. What I'm struggling with is: How do I protect those values? Is transmitting the data elements via secure HTTP connections satisfactory? Or are there other measures I would need to take with this scenario?

Answer 1

Encryption at transit

Assuming you're not storing these values (encryption at rest is a separate issue), the relevant PCI requirement is #4 "Encrypt transmission of cardholder data across open, public networks" clause 4.1 which requires you to ensure strong cryptography and security protocols.

Transmitting that data over HTTPS fits that requirement, it is acceptable as long as you ensure proper process (e.g. no possibility to downgrade to http, denying older protocols such as TLS1.1, etc). You do need to ensure that this data is not transmitted over other, insecure channels - for example, in communication with your customer service agents over email or some chat application, as per requirement #4.2.

Answer 2

Petris's answer is correct. To answer your question from a general perspective.

All the PCI DSS requirements apply to systems that store, process or transmit PAN.

Per Page 7 of PCI DSS v3.2.1

The primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date are stored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment (CDE), they must be protected in accordance with applicable PCI DSS requirements.

So the other data elements, when present with PAN, should also be stored, processed and transmitted in environments and applications that meet the PCI DSS requirements.

The footnote:

Additionally, other legislation (e.g., related to consumer personal data protection, privacy, identity theft, or data security) may require specific protection of this data, or proper disclosure of a company’s practices if consumer-related personal data is being collected during the course of business. PCI DSS, however, does not apply if PANs are not stored, processed, or transmitted.

says that if you don't store process or transmit PAN, then PCI DSS does not apply -- BUT BEWARE other legislation in your environment may still apply even if PCI DSS doesn't (e.g. GDPR etc) -- in which case you should protect them in the way you think compatible with the other legislation.