Sensitive authentication data may be transmitted or processed as part of a payment transaction, but what is the key storage rule?

Sensitive authentication data may be transmitted or processed as part of a payment transaction, but what is the key storage rule?

• A. It may be stored only for 24 hours
• B. It may be stored if encrypted
• C. It must be stored for audit purposes
• D. It may be transmitted or processed but must not be stored

Answer: (D)

The key rule here is that sensitive authentication data cannot be stored. You may transmit or process it as needed to complete a payment, but you must discard it after authorization and refrain from saving it anywhere in your systems. This protects against reuse of data like full track data, CVV/CVV2, PIN blocks, or other SAD if a breach occurs. Encrypting the data or handling it during the transaction does not override this prohibition—storage of SAD is not allowed, even in encrypted form. Only non-sensitive data or tokenized form should be retained for any future use.

The key rule here is that sensitive authentication data cannot be stored. You may transmit or process it as needed to complete a payment, but you must discard it after authorization and refrain from saving it anywhere in your systems. This protects against reuse of data like full track data, CVV/CVV2, PIN blocks, or other SAD if a breach occurs. Encrypting the data or handling it during the transaction does not override this prohibition—storage of SAD is not allowed, even in encrypted form. Only non-sensitive data or tokenized form should be retained for any future use.