Sensitive authentication data may be transmitted or processed as part of a payment transaction, but what is the key storage rule?

• A. It may be stored only for 24 hours
• B. It may be stored if encrypted
• C. It must be stored for audit purposes
• D. It may be transmitted or processed but must not be stored

Answer: (D)

The key rule here is that sensitive authentication data cannot be stored. You may transmit or process it as needed to complete a payment, but you must discard it after authorization and refrain from saving it anywhere in your systems. This protects against reuse of data like full track data, CVV/CVV2, PIN blocks, or other SAD if a breach occurs. Encrypting the data or handling it during the transaction does not override this prohibition—storage of SAD is not allowed, even in encrypted form. Only non-sensitive data or tokenized form should be retained for any future use.