Glossary · PCI DSS v4.0.1

Tokenisation — Tokenization

Tokenisation replaces the Primary Account Number with a surrogate value (a token) that has no exploitable value outside the tokenisation system, reducing where card data lives.

Find your SAQ Full glossary

What it means in practice

Tokenisation can materially reduce scope, but the tokenisation system itself and any place a token can be de-tokenised remain in scope.

Using a third-party tokenisation service makes the provider a TPSP subject to Requirement 12.8.

Not sure how this affects your assessment?

The free SAQ selector walks the official PCI SSC v4.0.1 decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Definitions paraphrased from the PCI DSS v4.0.1 standard and the PCI SSC Glossary of Terms, Abbreviations and Acronyms. Independent summary; not endorsed by PCI SSC.