Glossary · PCI DSS v4.0.1

Cardholder data — CHD

Cardholder data means the Primary Account Number and, when stored with it, cardholder name, expiration date and service code.

Find your SAQ Full glossary

What it means in practice

Cardholder data may be stored if it is protected as PCI DSS requires. Sensitive authentication data may not be stored after authorisation.

The presence of cardholder data anywhere in a system brings that system into scope.

Not sure how this affects your assessment?

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Definitions paraphrased from the PCI DSS v4.0.1 standard and the PCI SSC Glossary of Terms, Abbreviations and Acronyms. Independent summary; not endorsed by PCI SSC.