Discretionary Data

Applies to. PCI DSS v4.0.1 does not name discretionary data on its own; it is part of full track data, which the standard lists as sensitive authentication data, and Requirement 3 forbids storing full track data after authorisation even when encrypted. A merchant meets the term when a point-of-sale system, terminal log or debugging capture turns out to be writing the whole stripe read to disk; the only stripe elements that may be retained are the PAN, cardholder name, expiry date and service code, and only for a documented business need, so the discretionary field with its CVV1 or CAV1 must be gone once the authorisation response is received. Chip cards carry an equivalent field and the same rule applies to it.