Which magnetic stripe data elements may be retained for business needs?

• A. Cardholder's name, PAN, Expiration, Service code
• B. Full track data
• C. CVV
• D. PIN

Answer: (A)

Data-retention rules for magnetic stripe data under PCI DSS focus on what elements can be kept after a transaction is authorized. After authorization, you should not store the complete magnetic stripe data. However, certain essential card identifiers can be kept for legitimate business needs, such as future transactions or reconciliation. The elements that may be retained are the cardholder’s name, the primary account number (PAN), the expiration date, and the service code. These are standard identifiers that support ongoing business processes without preserving the sensitive data that is protected by PCI DSS.

Full track data contains the entire magnetic stripe contents, including sensitive fields and discretionary data, and storing it is prohibited. The CVV (card verification value) and PIN are sensitive authentication data that must not be stored after authorization. Therefore, the option listing the cardholder’s name, PAN, expiration date, and service code best fits what may be kept for business needs.