Data Breach
PCIComplianceHubLast updated
An incident in which unauthorized individuals gain access to sensitive information, such as payment card data, personal information, or intellectual property.
Applies to. PCI DSS v4.0.1 does not define data breach. The Council's term is compromise, and the standard's own control for the event is the incident response plan under Requirement 12, which must exist and be ready to activate. After a breach involving account data the payment brands may require a forensic investigation by a PCI Forensic Investigator (PFI), which is a brand and Council programme rather than a PCI DSS requirement.