Encryption of an entire storage drive, including the operating system, applications and data, so the contents are unreadable without the decryption key. FDE protects against physical loss or theft of a device and little else: once the system has booted and a user has authenticated, the data is transparently decrypted for anything running on that system. PCI DSS therefore restricts disk-level encryption as a means of rendering a stored primary account number unreadable. It is permitted on removable media, but on non-removable storage the PAN must also be rendered unreadable by another mechanism meeting Requirement 3.5.1, because logical access by an authenticated user or a compromised process defeats it entirely.
Applies to. Requirement 3.5.1.2 permits disk- or partition-level encryption as the sole means of rendering stored PAN unreadable only on removable electronic media; on non-removable media the PAN must also be protected by another method that meets 3.5.1. Where disk encryption is used for PAN at all, 3.5.1.3 requires that access to the decrypted data be controlled independently of the operating system's own logins, that decryption keys are not tied to user accounts, and that the passwords, passphrases or keys unlocking the disk are stored securely. Both apply to merchants and service providers alike.
Example. A merchant stores PAN on an encrypted USB drive for transport between sites; the drive's encryption alone satisfies 3.5.1.2 because the media is removable. Its database server also runs volume encryption, but that counts for nothing under 3.5.1 on its own: the PAN column must additionally be encrypted, tokenised, truncated or hashed, and the server's disk passphrase must not be unlocked by an administrator's operating system login.
Limits. FDE addresses loss or theft of hardware, not access by anyone or anything running on a booted system, which is why the standard refuses to accept it alone on fixed disks. It should not be confused with file-level, column-level or field-level encryption, which 3.5.1.2 and 3.5.1.3 explicitly exclude from their restrictions. Removable media is not exempt from the rest of the standard: the encryption on it still needs strong cryptography and managed keys under 3.5.1, 3.6 and 3.7.