{"id":1209,"date":"2021-03-12T09:31:07","date_gmt":"2021-03-12T09:31:07","guid":{"rendered":"http:\/\/www.pcidssguide.com\/?p=1209"},"modified":"2023-10-09T16:22:14","modified_gmt":"2023-10-09T16:22:14","slug":"what-are-the-pci-dss-data-retention-and-disposal-requirements","status":"publish","type":"post","link":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/","title":{"rendered":"What are the PCI DSS Data Retention and Disposal Requirements?"},"content":{"rendered":"\n\n\n\n\n<p>Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures. The purpose of the data storage and destruction procedure is to ensure that records no longer needed are deleted promptly and adequately.<\/p>\n\n\n\n<p>The PCI only allows the following credit card information storage if there is a recorded and authorized business need. All data must be secured in accordance with the PCI DSS in all sections. Storage of the following cardholder data protected as required by PCI DSS is permitted under this provision:<\/p>\n\n\n\n<ul>\n<li>When sensitive or credit card data is no longer required for legal, contractual, or business purposes, it must be destroyed.<\/li>\n\n\n\n<li>Paper containing cardholder data awaiting destruction should be stored in a secure container secured with a lock to prevent access to its contents.<\/li>\n\n\n\n<li>A quarterly automatic or manual process for identifying and securely deleting stored cardholder data that exceeds defined retention requirements should be in place.<\/li>\n\n\n\n<li>Each domain that receives credit cards as payment should review these procedures periodically (annually) to determine if any conditions require changes in their cardholder data retention or disposal method.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What are the PCI DSS Data Storage Requirements?<\/strong><\/h2>\n\n\n\n<p>Card data processed by organizations is not possible and necessary to be stored indefinitely or indefinitely. Card data should be kept for a period suitable for processing and then destroyed. However, these periods vary according to the sectors in which the enterprises operate and their affiliated laws. After these periods have expired, the data must be destroyed in the first periodic destruction period.<\/p>\n\n\n\n<p>PCI DSS Requirement 3.1 requires organizations to securely delete data that does not need to be stored for business or legal requirements. Thus, cardholder data cannot be recreated by malicious people.<\/p>\n\n\n\n<p>PCI DSS Requirement 3.1 states that organizations should keep cardholder data storage to a minimum by following data retention and disposal policies, procedures, and processes. The basic approach of PCI Requirement 3.1 is to get rid of the data if you don&#8217;t need it.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/how-to-permanently-delete-sensitive-authentication-data\/\">See Also: How to Permanently Delete Sensitive Authentication Data?<\/a><\/strong><\/p>\n\n\n\n<p>If specified in your contracts, it is acceptable to store data required for commercial or legal reasons. However, if you are storing unnecessary cardholder data, this becomes a liability for your organization.<\/p>\n\n\n\n<p>The PCI DSS states that to define appropriate retention requirements, an organization must first understand the legal or regulatory obligations applicable to its business needs and industries or the type of data being held.<\/p>\n\n\n\n<p>During a PCI assessment, the evaluator should review your data retention and disposal policies that summarize what data should be stored, where that data is located, why and how long you retained it.<\/p>\n\n\n\n<p>Then the evaluators will examine the data you have under your supervision. Reviewing the inventory is an essential part of the evaluation process. Whether it is physical print media or electronic, the assessor needs to see where the data is located.<\/p>\n\n\n\n<p>The assessors then equate the data&#8217;s lifetime to the organization&#8217;s data protection and disposal policies after taking a sample of it.<\/p>\n\n\n\n<p>PCI DSS stipulates that cardholder data storage should be kept to a minimum. If you don&#8217;t need it, you have to get rid of unnecessary data. Unless cardholder data needs to be stored for commercial or legal reasons, it must be securely deleted. When data exceeds the retention period, it becomes a liability for your business.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-log-retention-requirements\/\">See Also: What are the PCI DSS Log Retention Requirements?<\/a><\/strong><\/p>\n\n\n\n<p>How you safely delete data should be recorded in your organization&#8217;s data protection and disposal policies, protocols, and standards. Assessors expect that data can never be recreated if it is securely deleted.<\/p>\n\n\n\n<p>The print media must be fragmented and overwritten with the electronic data on the hard disk. The process of securely deleting information should be done either manually or through an automated process and should be done at least every three months.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What are the PCI DSS Data Destruction Requirements?<\/strong><\/h2>\n\n\n\n<p>PCI standards were created to provide secure environments for transmitting and storing cardholder data. Looking at PCI compliance from a data destruction perspective, when data storage media is no longer needed for commercial or legal reasons, organizations must render cardholder data electronically unrecoverable in such a way that it cannot be reconfigured.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/pci-dss-requirement-3\/\">See Also: PCI DSS Requirement 3 Explained<\/a><\/strong><\/p>\n\n\n\n<p>PCI recommends destruction using media-friendly methods such as secure erase or physical destruction of the media and through a secure erase program by industry-accepted standards.<\/p>\n\n\n\n<p>The Payment Card Industry does not endorse any process or company. Instead, your company should prove in an audit that your processes and suppliers meet the requirements.<\/p>\n\n\n\n<p>So what are the industry-accepted standards for secure data deletion? An example is the NIST 800-88 standard developed by the National Institute of Standards and Technology under the US Department of National Security sponsorship.<\/p>\n\n\n\n<p>NIST 800-88 requires a secure data cleansing process using professional, certified data deletion software. However, it is essential to note that the US government does not endorse cleaning software or companies to the NIST 800-88 standard.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/how-can-you-make-unreadable-stored-pan-information\/\">See Also: How can you make stored PAN information unreadable?<\/a><\/strong><\/p>\n\n\n\n<p>If you use software tools to delete data on hard drives yourself, you should determine how it is verified and whether it is certified in the countries that do it. To ensure your data cleansing provider uses secure processes and tools and can meet the NIST 800-88 standard with auditable records, you can query for certificates from a leading third-party organization, such as the National Information Destruction Association (NAID).<\/p>\n\n\n\n<p>Partnering with the data cleansing vendor that has received AAA certification from NAID is an essential step towards ensuring your company complies with the data destruction requirements of the PCI DSS.<\/p>\n\n\n\n<p>Generally, the reasons for the destruction of data are as follows:<\/p>\n\n\n\n<ul>\n<li>The amendment or abolition of the relevant legislation provisions that form the basis of its processing,<\/li>\n\n\n\n<li>The disappearance of the purpose requiring processing or storage,<\/li>\n\n\n\n<li>The data should be deleted when the maximum period for data storage has passed. There are no conditions to justify storing the data for a more extended period.<\/li>\n<\/ul>\n\n\n\n<p>Deleting data is the process of making the data inaccessible and unavailable for the relevant users. Organizations must take all necessary technical and administrative measures to ensure that deleted cardholder data are inaccessible and unavailable for appropriate users.<\/p>\n\n\n\n<p>The process to be followed in the process of deleting data is as follows:<\/p>\n\n\n\n<ul>\n<li>Determining the cardholder data that will constitute the subject of deletion.<\/li>\n\n\n\n<li>Using an access authorization and control matrix or a similar system, identify the relevant users for each data set.<\/li>\n\n\n\n<li>Determining the authorizations and methods of the relevant users, such as access, retrieval, and reuse.<\/li>\n\n\n\n<li>Closing and eliminating the access, retrieval, and reuse authorizations and methods of the relevant users within cardholder data scope.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What are the Methods of Destroying Data?<\/strong><\/h2>\n\n\n\n<p>The destruction of cardholder data is the process of making cardholder data inaccessible, unrecoverable and reusable in any way. Organizations are obliged to take all necessary technical and administrative measures regarding the destruction of cardholder data.<\/p>\n\n\n\n<p>Since cardholder data can be stored in various recording media, they must be destroyed by methods appropriate to the recording media. On the systems in question, one or more of the following methods may be used to delete cardholder data. Examples are given below:<\/p>\n\n\n\n<ul>\n<li><strong>De-magnetization:<\/strong> It is the process of unreadable distortion of the magnetic media data by passing it through a particular device and exposing it to a very high magnetic field.<\/li>\n\n\n\n<li><strong>Physical Destruction:<\/strong> Physical destruction of optical media and magnetic media such as melting, burning, or pulverizing. It is ensured that the data is inaccessible by processes such as melting, burning, crushing, or passing the optical or magnetic media through a metal grinder. If overwriting or de-magnetizing is not successful for solid-state disks, this media must also be physically destroyed.<\/li>\n\n\n\n<li><strong>Overwriting: <\/strong>It is the method of writing random data consisting of 0 and 1 at least seven times on magnetic media and rewritable optical media to avoid the recovery of old data. This process is done using special software.<\/li>\n<\/ul>\n\n\n\n<p>The following are the various destruction methods that can be used depending on the form of media:<\/p>\n\n\n\n<ul>\n<li><strong>Switches, routers, and other network devices: Inside these machines, t<\/strong>he storage media is fixed. Products often have a delete command but no destruction feature. It must be destroyed using one or more of the suitable methods mentioned above.<\/li>\n\n\n\n<li><strong>Flash-based <\/strong>environments: Those that have the interface of flash-based hard drives such as SATA or SCSI should be destroyed by using the block erase command if supported, using the manufacturer&#8217;s recommended destruction method if not supported, or using one or more of the appropriate techniques mentioned above.<\/li>\n\n\n\n<li><strong>Magnetic tape:<\/strong> These are the environments that store the data with micro magnet pieces on the flexible tape. It must be destroyed by exposing and de-magnetizing to solid magnetic media or by physical destruction methods such as burning or melting.<\/li>\n\n\n\n<li><strong>Units such as magnetic discs:<\/strong> These are media that store data with micro magnet parts on flexible (plate) or fixed media. It must be destroyed by exposing and de-magnetizing to solid magnetic media or by physical destruction methods such as burning or melting.<\/li>\n\n\n\n<li><strong>Mobile phones (Sim card and fixed memory areas): <\/strong>Portable smartphones have a delete command in fixed memory areas, but most do not have a destroy command. It must be destroyed using one or more of the suitable methods mentioned above.<\/li>\n\n\n\n<li><strong>Optical discs:<\/strong> These are data storage media such as CDs and DVDs. Physical destruction techniques such as incineration, fragmentation, and melting must be used to destroy it.<\/li>\n\n\n\n<li><strong>Peripherals such as printers with removable data recording media, fingerprint door access system:<\/strong> All data recording media must be verified to be removed and destroyed by using one or more of the above-mentioned appropriate methods according to their characteristics.<\/li>\n\n\n\n<li><strong>Peripherals such as printer, fingerprint door access system with fixed data recording media:<\/strong> Most of the systems in question have a delete command, but there is no destroying command. It must be destroyed using one or more of the suitable methods mentioned above.<\/li>\n<\/ul>\n\n\n\n<p>Since cardholder data in paper media is permanently and physically written on the media, the main media must be destroyed. While performing this process, it is necessary to divide the media into small pieces that are incomprehensible with paper shredding or shearing machines, horizontally and vertically, if possible, not to be put back together.<\/p>\n\n\n\n<p>Cardholder data transferred from the original paper format to the electronic environment by scanning should be destroyed by using one or more of the above-mentioned appropriate methods, depending on the electronic environment in which they are located.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures.<\/p>\n","protected":false},"author":1,"featured_media":1210,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[137,25],"tags":[3852,3851],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What are the PCI DSS Data Retention and Disposal Requirements? - PCI DSS GUIDE<\/title>\n<meta name=\"description\" content=\"Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What are the PCI DSS Data Retention and Disposal Requirements? - PCI DSS GUIDE\" \/>\n<meta property=\"og:description\" content=\"Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/\" \/>\n<meta property=\"og:site_name\" content=\"PCI DSS GUIDE\" \/>\n<meta property=\"article:published_time\" content=\"2021-03-12T09:31:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-09T16:22:14+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"828\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Surkay Baykara\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Surkay Baykara\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/\"},\"author\":{\"name\":\"Surkay Baykara\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"headline\":\"What are the PCI DSS Data Retention and Disposal Requirements?\",\"datePublished\":\"2021-03-12T09:31:07+00:00\",\"dateModified\":\"2023-10-09T16:22:14+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/\"},\"wordCount\":1772,\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg\",\"keywords\":[\"data destruction\",\"data retention\"],\"articleSection\":[\"Data Storage\",\"PCI DSS Requirement 3\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/\",\"url\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/\",\"name\":\"What are the PCI DSS Data Retention and Disposal Requirements? - PCI DSS GUIDE\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg\",\"datePublished\":\"2021-03-12T09:31:07+00:00\",\"dateModified\":\"2023-10-09T16:22:14+00:00\",\"description\":\"Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures.\",\"breadcrumb\":{\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage\",\"url\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg\",\"contentUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg\",\"width\":1200,\"height\":828,\"caption\":\"PCI DSS Data Retention and Destruction\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/pcidssguide.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What are the PCI DSS Data Retention and Disposal Requirements?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/pcidssguide.com\/#website\",\"url\":\"https:\/\/pcidssguide.com\/\",\"name\":\"PCI DSS GUIDE\",\"description\":\"PCI Compliance Guide For All Business\",\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/pcidssguide.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\",\"name\":\"Surkay Baykara\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"caption\":\"Surkay Baykara\"},\"logo\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\"},\"description\":\"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.\",\"sameAs\":[\"https:\/\/www.pcidssguide.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What are the PCI DSS Data Retention and Disposal Requirements? - PCI DSS GUIDE","description":"Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/","og_locale":"en_US","og_type":"article","og_title":"What are the PCI DSS Data Retention and Disposal Requirements? - PCI DSS GUIDE","og_description":"Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures.","og_url":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/","og_site_name":"PCI DSS GUIDE","article_published_time":"2021-03-12T09:31:07+00:00","article_modified_time":"2023-10-09T16:22:14+00:00","og_image":[{"width":1200,"height":828,"url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg","type":"image\/jpeg"}],"author":"Surkay Baykara","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Surkay Baykara","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#article","isPartOf":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/"},"author":{"name":"Surkay Baykara","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"headline":"What are the PCI DSS Data Retention and Disposal Requirements?","datePublished":"2021-03-12T09:31:07+00:00","dateModified":"2023-10-09T16:22:14+00:00","mainEntityOfPage":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/"},"wordCount":1772,"publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"image":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg","keywords":["data destruction","data retention"],"articleSection":["Data Storage","PCI DSS Requirement 3"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/","url":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/","name":"What are the PCI DSS Data Retention and Disposal Requirements? - PCI DSS GUIDE","isPartOf":{"@id":"https:\/\/pcidssguide.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage"},"image":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg","datePublished":"2021-03-12T09:31:07+00:00","dateModified":"2023-10-09T16:22:14+00:00","description":"Requirement 3.1 of the Payment Card Industry Data Security Standard (DSS) requires organizations to retain and follow data retention and disposal procedures.","breadcrumb":{"@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#primaryimage","url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg","contentUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2021\/03\/hard-drive-dispose.jpg","width":1200,"height":828,"caption":"PCI DSS Data Retention and Destruction"},{"@type":"BreadcrumbList","@id":"https:\/\/pcidssguide.com\/what-are-the-pci-dss-data-retention-and-disposal-requirements\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/pcidssguide.com\/"},{"@type":"ListItem","position":2,"name":"What are the PCI DSS Data Retention and Disposal Requirements?"}]},{"@type":"WebSite","@id":"https:\/\/pcidssguide.com\/#website","url":"https:\/\/pcidssguide.com\/","name":"PCI DSS GUIDE","description":"PCI Compliance Guide For All Business","publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pcidssguide.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741","name":"Surkay Baykara","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","caption":"Surkay Baykara"},"logo":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/"},"description":"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.","sameAs":["https:\/\/www.pcidssguide.com"]}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/1209"}],"collection":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/comments?post=1209"}],"version-history":[{"count":1,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/1209\/revisions"}],"predecessor-version":[{"id":2313,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/1209\/revisions\/2313"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media\/1210"}],"wp:attachment":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media?parent=1209"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/categories?post=1209"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/tags?post=1209"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}