Allowed to be Displayed/Stored: These data elements can be stored and displayed in compliance with PCI DSS 4.0 guidelines. For PAN, only the first 6 and last 4 digits can be displayed; the full PAN should never be stored or displayed in its entirety.
Not Allowed to be Displayed/Stored: These data elements must never be stored post-authorization or displayed as per PCI DSS 4.0 guidelines. This includes full track data, card verification codes, and PINs/PIN blocks.
Data Element | Allowed to be Displayed/Stored | Not Allowed to be Displayed/Stored |
Primary Account Number (PAN) | First 6 and last 4 digits only | Full PAN |
Cardholder Name | Yes | No |
Expiration Date | Yes | No |
Service Code | Yes | No |
Sensitive Authentication Data |
|
|
- Full Track Data (magnetic-stripe data or equivalent on a chip) | No | Yes |
- Card Verification Code (CVV, CVC, CID, CAV2) | No | Yes |
- PINs/PIN blocks | No | Yes |