What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of technical and operational requirements designed to protect payment account data.

PCI DSS applies to organisations that store, process or transmit cardholder data or sensitive authentication data, as well as organisations that could affect the security of that data.

Why PCI DSS is important

• It helps reduce the risk of payment-card fraud and data breaches.
• It sets consistent security requirements for handling payment account data.
• Merchants must validate their compliance in line with the requirements that apply to their business.
• Cardholder name
• Expiration date
• Service code
• Full track data from the magnetic stripe or chip equivalent.
• Card verification codes or values, such as CAV2, CVC2, CVV2 or CID.
• PINs and PIN blocks.

What is cardholder data?

Cardholder data includes the full Primary Account Number (PAN). It may also include the following when stored with the full PAN:

What is sensitive authentication data?

Sensitive authentication data is security information used to authenticate a cardholder or authorise a payment. It includes:

Keeping your compliance up to date

You must validate your PCI DSS compliance as required, usually each year. The validation method depends on your payment setup and the requirements that apply to your business.

Cashflows will provide information about the compliance process and any actions you need to complete. Keep your contact details up to date so you receive important PCI DSS communications.

More information

Visit the official PCI Security Standards Council website for the current PCI DSS standard, merchant guidance and supporting documents.