Also called: Account Data, Card Data, Customer Card Data
What cardholder data is
Cardholder data (CHD) is information from a payment card. Under PCI DSS, it includes at least the full primary account number (PAN). When stored with the PAN, the cardholder name, expiration date, and service code are also CHD. The full number is the key: a name or expiration date on its own is not CHD under this definition.
The PAN identifies the payment account and issuer. A card’s chip or magnetic stripe carries additional data used to authenticate and authorize a transaction. Those details do not all have the same storage rules.
If you do not need to keep the card number, do not keep it.
Why it matters to your business
PCI DSS applies to businesses that store, process, or transmit payment-card data. If you handle CHD, you need controls that protect it wherever it appears, including checkout systems, back-office computers, printed records, and storage devices. PCI DSS v4.0.1 is the current standard as of 2026.
A breach can bring investigation, customer communication, remediation, fraud, and dispute costs. Card brands can also impose non-compliance consequences under their rules. Outsourcing payment processing does not automatically remove your responsibility for protecting data handled by your business or its service providers.
What you must never store
After authorization, never store sensitive authentication data, even if it is encrypted. That includes full magnetic-stripe or chip track data, the card security code (CVV, CVC, or CID), and a PIN or PIN block. These are different from CHD, but they are part of account data and have stricter storage limits.
Store CHD only when your business needs it, and limit how long you retain it. Protect the PAN so it is unreadable wherever stored. Mask it when displayed: PCI guidance permits showing no more than the first six and last four digits, except for authorized people with a specific need. Receipts have stricter limits and should show only the last four digits.
Where the cost shows up
CHD does not have a standard per-transaction fee. The direct bill impact is more likely to appear as security work, investigation or remediation costs, or a monthly PCI non-compliance fee if your processor bills one while your business has not validated compliance. The fee amount and statement label depend on your agreement.
Keeping card numbers in spreadsheets, email, chat, or an unprotected device expands the places you must secure. Sending a PAN in unencrypted email, instant messages, or chat exposes it outside a controlled payment flow.
Reduce the data you handle
The simplest way to reduce storage risk is to avoid keeping card data you do not need. Use a payment flow that sends card details directly to a secure payment system, and use tokens instead of retaining card numbers for repeat billing. If you do retain CHD, restrict access, encrypt or otherwise render the PAN unreadable, and document retention and deletion rules.
Treat paper and digital records alike. Do not keep unmasked card details in receipts, terminals, or endpoint devices, and secure rooms holding data-storage equipment. A smaller data footprint means fewer systems and records to protect.
What you can actually change
- Map card data. Find every place your business receives, stores, processes, or transmits full card numbers, including paper records, email, and staff devices.
- Remove needless storage. Delete card data you no longer need, and stop collecting it in spreadsheets, chat, or unprotected files. Use tokens for repeat payments instead of retaining the PAN.
- Check PCI status. Confirm which PCI DSS validation applies to your payment setup and whether your statement includes a PCI non-compliance fee. Compare the fee against your current validation status.
Frequently asked questions
Is the card security code cardholder data?
The card security code is sensitive authentication data, not CHD under the narrow definition. You must never store it after authorization, even in encrypted form. This includes the three- or four-digit code printed on the card.
Does PCI DSS apply if I do not store card numbers?
PCI DSS applies to businesses that store, process, or transmit payment-card data. Not storing card numbers reduces exposure, but it does not by itself establish that your business is outside the standard’s scope. The payment flow matters.
How many digits of a card number can appear on a receipt?
Show only the last four digits of the PAN on a payment-card receipt. General PCI display guidance permits at most the first six and last four digits, but receipt requirements are stricter.