Sensitive Authentication Data (SAD)
PCIComplianceHubLast updated
Security-related information used to authenticate cardholders or authorise transactions: the full contents of any track from the magnetic stripe or chip, the card verification code printed on the card, and PINs and PIN blocks. PCI DSS prohibits storing it after authorisation, even encrypted, and requires it to be rendered unrecoverable once authorisation completes.
Applies to. Any entity that receives it during a transaction, including one that never intends to keep it: it turns up in logs, crash dumps, database tables and call recordings that were never designed to hold it.
Example. A call centre records calls for quality. A recording captures the customer reading out the three-digit code. That recording now stores sensitive authentication data after authorisation, and the recording system is in scope with a requirement it cannot meet while the recording exists.
Limits. The prohibition is absolute for merchants: 3.3.1 forbids storage after authorisation even if encrypted, and the only exception (3.3.3) is for issuers and companies supporting issuing services, with a documented business need. Before authorisation completes, SAD held electronically must be encrypted with strong cryptography (3.3.2). Keeping it for a few minutes is still storing it.