💼 3.2.1 Account data storage is kept to a minimum through implementation of data retention and disposal policies, procedures, and processes.
- ID:
/frameworks/pci-dss-v4.0/03/02/01
Description
Include at least the following:
- Coverage for all locations of stored account data.
- Coverage for any sensitive authentication data (SAD) stored prior to
completion of authorization. This bullet is a best practice until its
effective date; refer to Applicability Notes below for details.
- Limiting data storage amount and retention time to that which is required
for legal or regulatory, and/or business requirements.
- Specific retention requirements for stored account data that defines length
of retention period and includes a documented business justification.
- Processes for secure deletion or rendering account data unrecoverable when
no longer needed per the retention policy.
- A process for verifying, at least once every three months, that stored
account data exceeding the defined retention period has been securely deleted
or rendered unrecoverable.
Similar
- Sections
/frameworks/pci-dss-v3.2.1/03/01/frameworks/pci-dss-v4.0.1/03/02/01
- Internal
Similar Sections (Take Policies From)
Similar Sections (Give Policies To)
Sub Sections
| Section | Sub Sections | Internal Rules | Policies | Flags | Compliance |
|---|
Policies (1)