Frequently Asked Questions

< Back to search page

Does PCI DSS apply to paper with cardholder data (for example, receipts, reports, etc.)?

FAQ Response

Yes, PCI DSS requirements are applicable if a Primary Account Number (PAN) is stored, processed, or transmitted by any media, including paper records. PCI DSS Requirements 9.5 through 9.8 specifically addresses the safeguarding of physical media, including paper records, containing cardholder data.

(Note: PCI DSS Requirement numbers refer to PCI DSS version 3)

May 2014
Article Number 1069

Related Articles

What are acceptable formats for truncation of primary account numbers?

How does encrypted cardholder data impact PCI DSS scope for third-party service providers?

Does a QSA need to be onsite at the client’s premises for all aspects of a PCI DSS assessment?

If a merchant develops an application that runs on a consumer’s device (e.g. smartphone, tablet, or laptop) that is used to accept payment card data, what are the merchant’s obligations regarding PCI DSS and PA-DSS for that application?

How does encrypted cardholder data impact PCI DSS scope?