Privacy
PCIComplianceHubLast updated
The protection of an individual's personal information from unauthorized access, use, or disclosure. Privacy is an important consideration for organizations that handle cardholder data, and PCI DSS requirements help support privacy by mandating the protection of sensitive information.
Applies to. PCI DSS v4.0.1 does not address privacy and does not use the word in a requirement. It protects account data because it is payment data, not because it is personal data: PAN must be rendered unreadable wherever it is stored, and access to cardholder data must be tied to a unique ID and logged. Obligations that come from privacy law, such as notice, consent, retention limits and notifying affected individuals, sit outside the standard, although the incident response plan must include an analysis of legal requirements for reporting compromises.
Limits. PCI DSS compliance does not make an organisation compliant with privacy law, and privacy compliance does not satisfy PCI DSS.
Related. GDPR (General Data Protection Regulation), Confidentiality, Customer Information, Cardholder Data, Pseudonymization
Sources. PCI DSS v4.0.1 (June 2024)