3.2 Storage of account data is kept to a minimum
How to meet it
Define retention, store only what is needed, and securely delete the rest.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 3.2, in plain English.
3.2.1Stored account data is minimized via retention and disposal policies covering all locations, documented retention periods, secure deletion, and a quarterly check that data past retention is removed.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Data retention and disposal policyUse for ISO 27001 A.5.33, A.5.34, A.8.10, SOC 2 Confidentiality and Privacy, and PCI DSS requirement 3.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.Information classification and handling policyUse for ISO 27001 A.5.12, A.5.13, A.5.14, privacy, SOC 2 Confidentiality, and data handling controls.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.
Open the control-to-policy map← 3.1 Processes and mechanisms are defined and understood3.3 Sensitive authentication data (SAD) is not stored after authorisation →
Back to Requirement 3, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.