Keeping Data Safe – Storage and Destruction
Any type of cardholder data storage requires the prior approval of Merchant Services. The data needs to be protected against unauthorized access. Cardholder data should not be retained any longer than a documented business need; after which, it must be deleted or destroyed.
Reason for Directive
Credit card merchants at the University of Florida are required to follow strict procedures to protect customers’ payment card data and attest compliance with the Payment Card Industry Data Security Standard (PCI DSS). Failure to protect such information may result in financial loss for customers and the University, suspension of credit card processing privileges, fines imposed on credit card merchants and damage to the institution’s reputation.
Who Must Comply?
All University departments whose personnel store, process or transmit cardholder information. This also applies to units that outsource the processing of payment card information to third party vendors.
- Cardholder name
- Primary Account Number (PAN) (must always be unreadable anywhere it is stored and no more than the last four digits can be displayed)
- Expiration date
- Service code
Storing the three-digit verification code on the back of the card (or four-digits on the front) or PIN after authorization of a transaction is not allowed.
In addition, the following are required:
- Physical security controls to prevent unauthorized individuals from gaining access to the buildings, rooms, or cabinets that store the equipment, documents or any files containing cardholder data
- Cardholder data cannot be stored in a database, electronic file, or other electronic repository and cannot be stored on portable electronic media devices
Destruction of Data
A regular schedule of deleting or destroying data should be established in the merchant department to ensure that no cardholder data is kept beyond the record retention requirements.
The only acceptable destruction methods ensure that cardholder data cannot be reconstructed, and are:
- Cross-cut shredding
Convert information or data into a cipher or code, especially to prevent unauthorized access. [Back to Top]
Payment Card Industry Data Security Standard (PCI DSS)
The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers. PCI DSS also applies to all other entities that store, process or transmit cardholder data. [Back to Top]
Portable Electronic Media Devices
Include, but not limited to, laptops, compact disks, USB flash drives, personal digital assistants and portable external hard drives. [Back to Top]
Remove all but the last four digits of a credit card number from documentation. [Back to Top]
07/31/2021: reviewed content
TRM125 – Payment Card Security Awareness Training
Banking & Merchant Services: (352) 392-9057