What Account Data is
PCI DSS uses Account Data as an umbrella term for two categories: cardholder data and sensitive authentication data. Cardholder Data (CHD) is one part of Account Data, not a synonym for the whole term.
For your business, this distinction matters because the two categories include different information and have different handling rules. A payment card number is cardholder data. A card verification code or PIN is sensitive authentication data.
Account Data includes more than the card number, and sensitive authentication data cannot be stored after authorization.
What Account Data includes
Cardholder data includes the full primary account number (PAN), either on its own or together with the cardholder name, expiration date or service code. Sensitive authentication data includes full track data from a chip or magnetic stripe, the card verification code, and PIN or PIN block data.
Account Data is limited to these payment-card data categories. It does not mean every customer detail, bank account number or business account record your company holds. Keeping those records separate helps you define which systems handle card information.
How Account Data affects compliance and cost
Systems that store, process or transmit Account Data fall within PCI DSS responsibilities, along with systems that can affect the security of the cardholder data environment. More systems handling card data mean more work to secure and assess. As of 2026, PCI DSS v4.0.1 is the current version.
PCI DSS prohibits storing sensitive authentication data after authorization, even if it is encrypted. Stored PAN must be rendered unreadable. Processors commonly bill a monthly PCI non-compliance fee when a merchant has not validated compliance, but Account Data itself is not a transaction fee and the amount of any compliance fee is not set by this definition.
What you can actually change
You control what card data your business collects, where it goes and how long you keep it. The 51 future-dated PCI DSS v4.0 requirements became mandatory on March 31, 2025, so include current controls in your compliance work.
- Map where PAN, expiration dates, card verification codes and PIN data enter or pass through your business.
- Do not retain sensitive authentication data after authorization, even in encrypted form.
- Limit stored PAN and render it unreadable wherever it is kept.
- Review your PCI validation status and identify any monthly PCI non-compliance fee on your processing statement.
- Trace the data. Follow card information from checkout through your payment systems, including any reports or stored records.
- Remove prohibited storage. Check systems and logs for card verification codes, PIN data or full track data retained after authorization.
- Verify your status. Confirm your PCI validation is current and compare any PCI non-compliance fee with the validation status shown for your business.
Frequently asked questions
Is Account Data the same as Cardholder Data?
No. PCI DSS defines Account Data as cardholder data plus sensitive authentication data. Cardholder data includes the PAN and certain related card details, while sensitive authentication data includes items such as a card verification code, PIN or full track data.
Can a business store a card verification code?
You cannot store sensitive authentication data, including a card verification code, after authorization, even if it is encrypted. Review payment forms, logs and saved records so the code is not retained after the transaction is authorized.
Does Account Data create a processing fee?
Account Data is a PCI DSS classification, not a card-network transaction fee. Processors commonly bill a monthly PCI non-compliance fee when a merchant has not validated compliance, but the fee amount is not defined by Account Data.