P2PE (Point-to-Point Encryption)
PCIComplianceHubLast updated
A technology that encrypts cardholder data from the point of capture at the merchant until it reaches the payment processor, ensuring that the data remains unreadable even if intercepted. P2PE can help merchants achieve PCI DSS compliance by reducing the scope of their cardholder data environment.
Applies to. No PCI DSS v4.0.1 requirement names P2PE; it reaches merchants through scoping and the SAQs. A merchant that uses a solution on the Council's P2PE list, with the listed POI devices and the solution's P2PE Instruction Manual followed, never sees cleartext account data and can use SAQ P2PE, which keeps a short set of requirements: the physical protection of the devices under Requirement 9, limits on any paper records under Requirement 3 and the policy items of Requirement 12. A terminal that encrypts but is not part of a listed solution may still cut risk, but it does not earn SAQ P2PE, and the merchant's scope is then for the acquirer to decide.