1

Can I store following holder data according the PCI DSS v3:

  • last 4 digits of the card number;
  • expiration month;
  • expiration year;
  • first name;
  • last name;
  • zip code;
  • country?

If no, which way I can follow to store them?

P.S. I've found this answer, but it's related to v2.

Update: Also, I found this article with the following comment: "...Truncation – removing a data segment, such as showing only the last four digits...", but I'm not sure that it's actual information related to the v3.

Community
  • 1
Nikita Sviridenko
  • 13
  • 4
  • This appears borderline off topic under the "specific system" close reason, which requires that the asker demonstrates an understanding of the problem. Can you **[edit]** your question to show what research you have done in order to try to answer this yourself before asking us? – user Nov 26 '16 at 18:51

1 Answers1

3

Can I store following holder data according the PCI DSS v3:

In short: Yes, you may store all of that data, without encryption, under the DSS, as long as you're not storing the PAN (the credit card number).

However, some of that information falls under the PII regulations of various states, and your failure to protect it would be subject to various fines. So just because the DSS doesn't care doesn't mean you shouldn't.

In detail:

The DSS 3.2 states (emphasis mine):

PCI DSS also applies to all other entities that store, process or transmit cardholder data (CHD) and/or sensitive authentication data (SAD)

CHD and SAD are defined as follows (also in DSS 3.2):

DSS 3.2 Data Definitions

While cardholder name and expiration date are listed under CHD, the following caveat states that they are only considered CHD in conjunction with the PAN (emphasis original to the DSS):

The primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date are stored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment (CDE), they must be protected in accordance with applicable PCI DSS requirements.

By implication, if the PAN is not present, then the other listed data fields do not need to be protected as per DSS requirements.

Finally, while these quotes are from the DSS 3.2, they're largely unchanged from 3.0/3.1 and 2.x (to the best of my recollection; I haven't doublechecked).

gowenfawr
  • 71,975
  • 17
  • 161
  • 198
  • Thank you! I see this information too, but there is no information about the quantity of digits that I can store. Am I storing the PAN, when I'm storing just some part of it (last 4 digits)? – Nikita Sviridenko Nov 29 '16 at 13:58
  • @NikitaSviridenko, according to section 3.3 of the DSS "the first six and last four digits are the maximum number of digits to be displayed"; note that for certain uses (like receipts) there are more stringent limits in place. But first 6/last 4 is a good guide for what's acceptably not a PAN. – gowenfawr Nov 30 '16 at 16:22