Truncation

PCIComplianceHubLast updated 22 September 2026

Permanently removing part of the primary account number so the full number cannot be recovered from what remains, for example keeping only the first six and last four digits. Truncation is one of the methods PCI DSS accepts for rendering a stored PAN unreadable, and it is not the same as masking: masking hides digits at the point of display while the full PAN is still held, whereas truncation destroys the removed digits outright. Truncated data falls out of scope only conditionally. The format has to stay within the digits PCI SSC permits for the business need; the same PAN must not be truncated to two different formats that can be correlated to rebuild digits; and truncated values must not sit alongside a hash of the same PAN, from which the original is trivial to reconstruct. The system performing the truncation handles the full PAN and stays in scope regardless.

Applies to. Any entity storing PAN that wants to store less of it. The system that performs the truncation handles the full PAN and stays in scope.

Example. A receipt system keeps the first six and last four digits and discards the middle digits at the moment of capture. The stored value cannot be turned back into the PAN.

Limits. Truncation is for PAN that is stored, processed or transmitted; masking is the equivalent for display and print, and the Council keeps the two apart. Truncated data is out of scope only on conditions: the retained digits stay within what the Council permits, the same PAN is not truncated in two formats that together rebuild it, and a truncated value does not sit beside a hash of the same PAN. 3.5.1 accepts truncation as one of four ways of rendering stored PAN unreadable, with keyed hashing, index tokens and strong cryptography.

In PCI DSS v4.0.1. 3.4.1, 3.5.1

Sources. PCI DSS v4.0.1, Appendix G: Glossary of Terms, Abbreviations, and Acronyms, PCI DSS v4.0.1 (June 2024)