Data Encrypting Key (DEK)
PCIComplianceHubLast updated
The cryptographic key that actually encrypts and decrypts stored or transmitted data, as distinct from a key encrypting key that protects other keys. Under PCI DSS a data encrypting key must be protected wherever it exists, held in the fewest possible locations, and rotated at the end of its defined cryptoperiod.