Guide
Cardholder data, and why finding it comes first
Cardholder data defines your PCI DSS scope. So every assessment starts by finding where it is stored, processed or transmitted, including the places nobody planned.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What counts as cardholder data
The primary account number is the core element. Also, other elements count when stored with it.
| Element | Category |
|---|---|
| Primary account number | Cardholder data |
| Cardholder name | Cardholder data, when with the PAN |
| Expiration date | Cardholder data, when with the PAN |
| Service code | Cardholder data, when with the PAN |
| Full track data, security code, PIN | Sensitive authentication data |
Cardholder data compared with sensitive authentication data
Together they form what the standard calls account data. However, sensitive authentication data must never be stored after authorisation. So the rules differ sharply.
Cardholder data discovery check
Tick what you can show today.
Your result appears here as you tick, so you can see what is still open.
Where cardholder data hides
The planned database is rarely the problem. For example, card numbers turn up in emails and logs.
- Customer emails and chat transcripts
- Call recordings
- Application logs
- Spreadsheets and exports
- Backups
Shrinking your scope
Less data means a smaller assessment. Therefore hosted payment pages, tokenisation and validated encryption solutions often cut scope sharply.
Where we help
We run data discovery and design scope reduction before assessment. Gap analysis runs $8,000 to $40,000. We are not a QSA. Definitions are in the PCI SSC document library.
Also repeat discovery after major changes. For example, a new CRM or chat tool can start collecting numbers without anyone noticing. So treat discovery as a routine. In addition, teach staff a simple rule: never write down or paste a full card number.
Cardholder data questions
Is a card number alone enough to count?
Yes. The PAN by itself is in scope, even without a name or date attached.
Is a truncated number still cardholder data?
Properly truncated numbers are generally out of scope, but the method must meet the standard.
Where should cardholder data discovery start?
With a data flow diagram, then a search of systems for stored numbers.
Can we store the CVV for recurring billing?
No. Security codes must not be stored after authorisation.
Related guides
Find your cardholder data before your assessor does
Send five answers about your systems. We reply with a written estimate, usually inside one business day. Also list the tools staff use for support and refunds, because card numbers often hide there. So discovery starts in the right places. In addition, mention any recent system changes, because new tools often create new copies. As a result, the estimate reflects where the real work sits.
Get my written estimate