Non-Consumer User

PCIComplianceHubLast updated

A user who is not a consumer or end customer, typically referring to employees, contractors, or other individuals with access to a company's systems, networks, or data. Non-consumer users may have access to sensitive cardholder data and should be subject to PCI DSS controls to ensure the security of that data.

Applies to. Requirements 7 and 8 are written for non-consumer users: the employees, administrators, contractors and third parties who access system components, rather than the cardholders whose data those systems hold. Requirement 8's identification and authentication requirements do not apply to accounts that consumers (cardholders) use, so a customer login on an e-commerce site sits outside them while a staff, administrator or vendor login sits inside.
Related. Consumer, Cardholder, Personnel, Account, Privileged User
Sources. PCI DSS v4.0.1 (June 2024)