Under the PCI Data Security Standard, cardholder data is the full Primary Account Number (PAN) together with any of three other elements tied to it: the cardholder’s name, the card’s expiration date, and the service code encoded in the magnetic stripe.1PCI Security Standards Council. Glossary – PCI Security Standards Council The PAN is the trigger. Without it, the other elements standing alone generally sit outside PCI DSS scope; once the PAN enters your environment, everything associated with it does too. A second category, sensitive authentication data, looks similar but is governed by a stricter rule you need to understand before you store anything.
The Four Elements That Make Up Cardholder Data
PCI DSS recognizes exactly four data elements as cardholder data:
- Primary Account Number (PAN): the 15- or 16-digit account number printed across the face of a credit or debit card. This is the element that must be present for anything to qualify as cardholder data.
- Cardholder name: the name embossed or printed on the card and tied to the account.
- Expiration date: the month and year the card ceases to be valid.
- Service code: a three- or four-digit value in the magnetic stripe that tells the terminal how the card should be processed, including whether it is chip-capable, international, or PIN-required.
If your business has a legitimate need for any of these, you can keep them, but only when you protect them under PCI DSS Requirement 3, which governs stored cardholder data.2PCI Security Standards Council. PCI Data Storage Dos and Donts The rule is different for the next category.
Sensitive Authentication Data Is Not Cardholder Data, and You Cannot Store It
PCI DSS treats sensitive authentication data (SAD) as its own category, separate from cardholder data. SAD is the information used during authorization to verify a transaction is legitimate, and the rule is absolute: you cannot store it after authorization, even encrypted.3PCI Security Standards Council. Why Is Storage of Sensitive Authentication Data After Authorization Not Permitted
Three data types are SAD:
- Full magnetic stripe or equivalent chip data (Track 1 and Track 2), which contains everything needed to clone a card.
- Card verification codes (CVV2, CVC2, CAV2), the three- or four-digit number printed on the card and used to verify card-not-present transactions.
- PINs and PIN blocks, used to authenticate debit transactions.
The prohibition on storing SAD applies even when no PAN exists in your environment.3PCI Security Standards Council. Why Is Storage of Sensitive Authentication Data After Authorization Not Permitted The logic: if an attacker pulls a CVV from one merchant and a PAN from another and correlates them through shared identifiers like an email address, the issuing bank loses its ability to detect the fraud. Recurring billing and card-on-file transactions do not require the verification code, so there is no legitimate business reason to retain it.
This is where most compliance failures turn catastrophic. Storing PANs without proper encryption exposes you to fines and remediation costs. Storing full track data or CVVs after authorization can lead to removal from payment networks entirely.2PCI Security Standards Council. PCI Data Storage Dos and Donts
How Stored Cardholder Data Must Be Protected
PCI DSS Requirement 3 sets out how the PAN must be rendered unreadable wherever it is stored, whether in a production database, a backup tape, or a log file.2PCI Security Standards Council. PCI Data Storage Dos and Donts Four methods are permitted:
- Strong cryptography: encrypting the PAN with a robust algorithm and managing the keys through documented procedures. This is the usual choice when your systems need to retrieve the full number later.
- One-way hashing: running the entire PAN through a cryptographic hash function to produce a fixed-length output. The process is irreversible, so the original number cannot be recovered from the hash alone.
- Truncation: permanently removing part of the PAN so only a portion remains, typically no more than the first six and last four digits. Truncation destroys data rather than hiding it.
- Tokenization: replacing the PAN with a substitute value that has no exploitable meaning if stolen. The actual PAN is held in a separate, secured vault.
Each method involves trade-offs. Encryption keeps the PAN retrievable but creates key management obligations. Truncation and hashing are simpler but one-directional. Tokenization has become popular with merchants that want card-on-file functionality without carrying PANs across every internal system.
Where Cardholder Data Ends Up That You May Not Have Considered
Payment terminals and encrypted vaults are built for this data. The compliance risk lives in the overflow, the copies that accumulate outside the systems designed to hold cardholder data.
Physically, printed receipts may still show a truncated account number and cardholder name. Merchant transaction logs, older imprint carbons, and handwritten notes from phone orders all count as cardholder data if any portion of the PAN appears. Cross-cut shredding or locked destruction bins are the standard disposal methods for any physical record containing account details.
Digitally, exposure points multiply. System logs generated during processing can capture card numbers when logging is not properly configured. Employees copying transaction records into spreadsheets for reconciliation create unencrypted duplicates outside the secured environment. Email is one of the worst offenders: customers routinely send full card numbers in plaintext to resolve billing disputes, and those messages then sit in an inbox, a backup, and possibly a forwarded thread. Off-site backup tapes also carry copies. Regular data discovery scans are how IT teams find and purge these unauthorized copies before an assessor or an attacker does.
Receipt Truncation Under FACTA
A separate federal rule applies to receipts regardless of PCI DSS. Under the Fair and Accurate Credit Transactions Act, any business that accepts credit or debit cards may not print more than the last five digits of the card number on an electronically generated receipt, and the expiration date cannot appear at all.4Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports The rule reaches only machine-printed receipts; handwritten records and manual imprints are exempt.
Willful violations carry statutory damages of $100 to $1,000 per affected consumer, and class exposure can multiply that across every customer who received a non-compliant receipt. Modern terminals truncate by default, so violations today usually trace to legacy equipment, misconfigured systems, or custom receipt templates that were never updated.
What Non-Compliance Actually Costs
The PCI Security Standards Council does not levy fines. That authority sits with the card brands (Visa, Mastercard, American Express, Discover, JCB) and is exercised through the acquiring bank that maintains your merchant account.5PCI Security Standards Council. About Us – PCI Security Standards Council The penalty structure is contractual, not statutory, so exact figures vary by brand and acquirer.
For merchants that simply have not submitted their annual self-assessment or vulnerability scan, processors commonly charge a monthly non-compliance fee in the range of $20 to $100. For larger merchants or those found non-compliant after a breach, card brand fines escalate: roughly $5,000 to $10,000 per month early on, climbing to $25,000 to $50,000 per month, and eventually exceeding $100,000 per month if the issue is not resolved. Fines tied to a security breach where the merchant was non-compliant at the time can reach $500,000 per incident.
The financial fallout from the breach itself is larger than the fines. IBM’s 2025 Cost of a Data Breach report put the global average breach cost at $4.4 million, covering detection, notification, credit monitoring, legal exposure, and lost business.6IBM. Cost of a Data Breach Report 2025 A post-breach forensic investigation led by a Qualified Security Assessor, separate from your annual assessment, can cost $30,000 to $200,000 depending on the size and complexity of the environment.
The reason the definition matters is practical. Every system that touches the PAN, and every copy of it in an inbox, a spreadsheet, or a log file, sits inside PCI DSS scope and inside that penalty structure. Everything you can keep out, whether by tokenization, truncation, or simply not collecting it, is scope you do not have to defend.