💼 3.2 Do not store sensitive authentication data after authorization (even if encrypted).

• Contextual name: 💼 3.2 Do not store sensitive authentication data after authorization (even if encrypted).

• ID: /frameworks/pci-dss-v3.2.1/03/02

• Located in: 💼 3 Protect stored cardholder data

Description

If sensitive authentication data is received, render all data unrecoverable upon completion of the authorization process.

It is permissible for issuers and companies that support issuing services to store sensitive authentication data if:

• There is a business justification and
• The data is stored securely.

Similar

• Sections
  • /frameworks/pci-dss-v4.0/03/03/01
  • /frameworks/pci-dss-v4.0/03/03/03
• Internal
  • ID: dec-c-d5d99c21

Similar Sections (Take Policies From)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v4.0 → 💼 3.3.1 SAD is not retained after authorization, even if encrypted.	3
💼 PCI DSS v4.0 → 💼 3.3.3 Any storage of sensitive authentication data is limited to that which is needed for a legitimate issuing business need, is secured and encrypted using strong cryptography.

Similar Sections (Give Policies To)

Section	Sub Sections	Internal Rules	Policies	Flags
💼 PCI DSS v4.0 → 💼 3.3.1 SAD is not retained after authorization, even if encrypted.	3
💼 PCI DSS v4.0 → 💼 3.3.3 Any storage of sensitive authentication data is limited to that which is needed for a legitimate issuing business need, is secured and encrypted using strong cryptography.

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 3.2.1 Do not store the full contents of any track after authorization.
💼 3.2.2 Do not store the card verification code or value after authorization.
💼 3.2.3 Do not store the personal identification number (PIN) or the encrypted PIN block after authorization.