I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN number is encrypted before storing and the site uses SSL to transmit the data to the payment gateway. Do we still need to comply with PCI DSS Requirements if we store encrypted cardholder data???
Yes, if you receive, transmit, or store cardholder data in any form, you are required to comply with PCI-DSS. In fact, one of the things that you're required to do under PCI-DSS is encrypt that data using strong encryption. Though I am not a PCI auditor, I would suspect that RC2 would not, if fact, be considered strong encryption, so not only are you subject to PCI-DSS, you may be violating it as well.
A survey of businesses in the U.S. and Europe reveals activities that may put cardholder data at risk.
81% store payment card numbers
73% store payment card expiration dates
71% store payment card verification codes
57% store customer data from the payment card magnetic stripe
16% store other personal data
Source: Forrester Consulting: The State of PCI Compliance (commissioned by RSA/EMC)
DON'T DO IT
Requirement 3: Protect stored cardholder data
In general, no cardholder data should ever be stored unless it’s necessary to meet the needs of the business. Sensitive data on the magnetic stripe or chip must never be stored.
If your organization stores PAN, it is crucial to render it unreadable (see 3.4 ).
3.4 Render PAN, at minimum, unreadable anywhere it is stored – including on portable digital media, backup media, in logs, and data received from or stored by wireless networks. Technology solutions for this requirement may include strong one-way hash functions, truncation, index tokens, securely stored pads, or strong cryptography. (See PCI DSS Glossary for definition of strong cryptography.)