Glossary · PCI DSS v4.0.1

PAN — Primary Account Number

The Primary Account Number (PAN) is the payment card number that identifies the issuer and the cardholder account. It is the defining element of cardholder data — if PAN is present, PCI DSS applies.

Find your SAQ Full glossary

What it means in practice

Where PAN is stored it must be rendered unreadable, for example by strong cryptography, truncation, tokenisation or a keyed hash.

When displayed, PAN must be masked so that only the personnel with a documented business need can see more than the first six and last four digits.

Not sure how this affects your assessment?

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Definitions paraphrased from the PCI DSS v4.0.1 standard and the PCI SSC Glossary of Terms, Abbreviations and Acronyms. Independent summary; not endorsed by PCI SSC.