PCI DSS Payment Card Data Retention

This guidance explains PCI DSS v4.0.1 requirements for minimizing storage and retention of payment card Account Data, detailing mandatory retention policy elements, quarterly verification of deletions, and secure disposal procedures; it also describes techniques to reduce PCI DSS scope such as separating CHD from PAN, rendering PANs unrecoverable via keyed hashing, truncation, or tokenization, and emphasizes that Sensitive Authentication Data must never be stored after authorization.