PCI-DSS Cardholder Data Protection
PCI_DSSfree16 data-quality rules for PCI-DSS v4.0.1 cardholder data (CHD) and sensitive authentication data (SAD) handling. Covers PAN masking (max first-6/last-4), Luhn validity, prohibited storage of full track data / CVV / PIN blocks, strong PAN rendering (encryption/tokenization), retention limits, expiry-date range, IIN/BIN presence, encryption-at-rest indicators, key-rotation freshness, and cardholder-name PII completeness. Fails any record that exposes clear-text PAN or stores SAD post-authorization.
Checks included (16)
PAN Masked (First 6 / Last 4 Max)
PCI-DSS 3.4.1 — when displayed, PAN must be masked so at most the first six and last four digits are visible. Any stored/displayed value showing more than 10 digits in clear is a violation.
PAN Passes Luhn Check
A full PAN (when legitimately present in a secured processing context) must satisfy the Luhn mod-10 check digit. Invalid PANs indicate corrupt or fabricated card data.
Stored PAN Rendered Unreadable
PCI-DSS 3.5.1 — stored PAN must be rendered unreadable (strong cryptography, truncation, tokenization, or one-way hash). A raw 13-19 digit numeric PAN in a storage column is prohibited.
Card Brand In Accepted Network Set
The card brand must be a recognized payment network so downstream processing and interchange routing works correctly.
No Full Track (Magnetic Stripe) Data Stored
PCI-DSS 3.3.1 — full track data (track 1/2) must NEVER be stored after authorization. Presence of a track_data / sensitive-authentication column with any value is a critical violation.
No CVV / CVC / CVV2 Stored
PCI-DSS 3.3.2 — the card verification value (CVV/CVC/CVV2/CID) must not be stored after authorization. Any populated cvv column is a critical breach.
No PIN / PIN Block Stored
PCI-DSS 3.3.3 — the PIN and encrypted PIN block must not be retained after authorization. Any populated pin/pin_block column is a critical violation.
No Prohibited SAD Columns In Schema
Defense in depth: the post-authorization schema must not even define columns for sensitive authentication data (cvv, track_data, pin_block). Presence of such columns in information_schema is a design violation.
IIN / BIN Prefix Present
Tokenized card records must retain a valid issuer identification number (IIN/BIN) first-6 for routing and network identification. A record with no IIN cannot be routed.
Cardholder Records Flagged Encrypted-At-Rest
Every stored cardholder-data record must carry an encryption indicator proving it is protected at rest (Requirement 3.5). Records missing the flag, or flagged unencrypted, fail.
Cardholder Name Present
When cardholder name is stored as part of cardholder data, it must be populated; a blank name breaks reconciliation and dispute handling.
Card Expiry In Valid Range
The expiry month must be 01-12 and the expiry year must be within a plausible window (not in the past beyond a grace period, not more than ~10 years out). Out-of-range expiries indicate corrupt data.
Masked PAN Length Plausible
The total number of digit positions in a masked PAN must be a plausible card length (13-19) so masking did not corrupt the underlying value.
Encryption Keys Rotated Within Cryptoperiod
PCI-DSS 3.6/3.7 — cryptographic keys must be rotated at the end of their defined cryptoperiod. Any active key whose last rotation exceeds the configured max age fails.
CHD Retention Within Policy
PCI-DSS 3.2.1 — cardholder data must not be retained longer than the documented business/legal need. Records older than the retention limit must be purged.
Card Token Unique Per Card
Each surrogate token must map to exactly one card; duplicate tokens across different underlying cards break the tokenization guarantee.