An e-commerce company's order database stores customers' full primary account numbers (PANs) from payment cards so returning customers can check out faster. Which compliance obligation applies to this storage?
Select an answer to reveal the explanation.
Short Explanation
The moment you store card numbers, you're in the payment card industry's world, and PCI DSS comes along for the ride. Stored PANs have to be unreadable, through encryption, truncation or tokenization, and tightly controlled. Don't fall for 'that's the processor's problem'; if your database holds the PAN, you're in scope.
Full Explanation
The Payment Card Industry Data Security Standard applies to any entity that stores, processes or transmits cardholder data, which includes a merchant database holding full primary account numbers. Among its requirements, stored PANs must be rendered unreadable wherever they are kept, using methods such as strong cryptography with sound key management, truncation, one-way hashes or index tokens, and access to cardholder data must be limited to those with a business need. Sensitive authentication data such as card verification codes must not be stored after authorization at all. Privacy laws such as GDPR may also apply to the same data, but they do not replace PCI DSS, which is a contractual obligation imposed through the card brands and acquirers. Claiming only the payment processor is in scope is incorrect; storing PANs places the merchant's systems in scope. HIPAA governs protected health information in the healthcare context, and payment card numbers are not PHI. Exam caveat: many organizations reduce their obligations by not storing PANs at all, relying on tokenization from the payment provider, which shrinks the cardholder data environment. Operational check: scan the database for unencrypted PAN patterns, confirm no card verification codes are stored, and verify access to the card table is limited and logged.