Glossary · PCI DSS v4.0.1

SAD — Sensitive Authentication Data

Sensitive authentication data (SAD) is full track data, card verification codes (CAV2/CVC2/CVV2/CID) and PINs or PIN blocks. SAD must never be retained after authorisation, even if encrypted.

Find your SAQ Full glossary

What it means in practice

Requirement 3.2.1 prohibits storage of SAD after authorisation; issuers and issuer processors may retain it only with a documented business justification and secure storage.

SAD found in logs, debug traces, crash dumps or support tickets is one of the most common assessment failures.

Not sure how this affects your assessment?

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Definitions paraphrased from the PCI DSS v4.0.1 standard and the PCI SSC Glossary of Terms, Abbreviations and Acronyms. Independent summary; not endorsed by PCI SSC.