Cardholder data refers to any information associated with a payment card that can identify the cardholder or facilitate fraudulent transactions, including the primary account number (PAN), cardholder name, expiration date, and service code.
Under PCI DSS requirements, organizations must protect this data through:
- Encryption during transmission
- Secure storage practices
- Strict access controls
The PAN must never be stored alongside sensitive authentication data such as CVV or PIN after authorisation.
See also:
