Transaction Data

Applies to. PCI DSS v4.0.1 does not use transaction data as a category; its line is drawn around account data, the cardholder data and sensitive authentication data inside a transaction record. When a merchant keeps transaction records for reconciliation, refunds or disputes, the assessor looks at the fields: a full PAN in a sales ledger, receipt copy or export puts that system in scope and Requirement 3 requires it to be rendered unreadable, while a record holding only the amount, date, a properly truncated PAN and a processor reference is outside the standard's concern. Requirement 3 also asks the entity to set retention periods and delete stored account data once the business need has passed, which for most merchants means keeping the transaction record and dropping the PAN.