A CHD retention policy must include the following element?

A CHD retention policy must include the following element?

• A. Limiting data storage amount & retention time limited to legal/regulatory/business requirements
• B. Unlimited retention of CHD
• C. Physical destruction upon every transaction
• D. No retention requirement

Answer: (A)

The main idea is limiting how long and how much cardholder data you store. PCI DSS requires you keep only as much CHD as you truly need for legal, regulatory, or business purposes, and you should purge data when it’s no longer needed. This data-minimization approach reduces the risk of exposure and makes compliance easier because you’re not holding sensitive information longer than necessary. Why this is the best fit: it directly aligns with reducing CHD exposure and setting clear retention limits tied to legitimate needs. It also supports regular review and secure deletion of data when no longer required. Why the others don’t fit: keeping CHD indefinitely increases risk and isn’t compliant with the principle of data minimization; destroying data after every transaction isn’t a practical or standard policy for most business needs; having no retention requirement ignores regulatory, legal, and business needs that sometimes require keeping data for a specified period.

The main idea is limiting how long and how much cardholder data you store. PCI DSS requires you keep only as much CHD as you truly need for legal, regulatory, or business purposes, and you should purge data when it’s no longer needed. This data-minimization approach reduces the risk of exposure and makes compliance easier because you’re not holding sensitive information longer than necessary.

Why this is the best fit: it directly aligns with reducing CHD exposure and setting clear retention limits tied to legitimate needs. It also supports regular review and secure deletion of data when no longer required.

Why the others don’t fit: keeping CHD indefinitely increases risk and isn’t compliant with the principle of data minimization; destroying data after every transaction isn’t a practical or standard policy for most business needs; having no retention requirement ignores regulatory, legal, and business needs that sometimes require keeping data for a specified period.