Which practice minimizes cardholder data (CHD) storage by enforcing limits on data retention?

• A. Specific retention requirements for CHD
• B. Limiting data storage amount & retention time to that which is required for legal, regulatory, and/or business requirements
• C. A quarterly process for IDing & securely deleting stored CHD that exceeds defined retention
• D. Processes for secure deletion of data when no longer needed

Answer: (B)

Limiting what you store and for how long is the most effective way to reduce cardholder data because it enforces data minimization from the outset. By keeping CHD only as long as legally, regulatorily, or business-reasonably required, you prevent unnecessary data retention and automatically shrink the scope of sensitive information that could be exposed. This proactive approach directly reduces risk and the amount of data that needs protection, monitoring, and later deletion.

Other practices—like identifying and securely deleting data that has exceeded a defined retention, or deleting data when it’s no longer needed—are important safeguards but are reactive or narrower in scope. They don’t guarantee that data isn’t stored longer than necessary in the first place. Setting explicit limits on both data quantity and retention time ensures CHD is kept only for the minimal, required period.