Which statement about magnetic stripe data retention after authorization is true?

Which statement about magnetic stripe data retention after authorization is true?

• A. The following data elements may be retained: cardholder's name, PAN, expiration date, and service code.
• B. Full track data must be retained after authorization.
• C. The card verification code may be retained after authorization.
• D. No magnetic stripe data may be retained.

Answer: (A)

After authorization, you should keep only the minimum cardholder data elements necessary for business needs, and you must not retain full magnetic stripe data. The data elements that may be retained are the cardholder's name, the PAN, the expiration date, and the service code. This allows ongoing processing or record-keeping without exposing the complete magnetic stripe information. Retaining full track data is not permitted after authorization, and the card verification code should not be retained once authorization is complete. So, the statement listing the allowed elements—name, PAN, expiration date, and service code—best reflects the correct practice.

After authorization, you should keep only the minimum cardholder data elements necessary for business needs, and you must not retain full magnetic stripe data. The data elements that may be retained are the cardholder's name, the PAN, the expiration date, and the service code. This allows ongoing processing or record-keeping without exposing the complete magnetic stripe information. Retaining full track data is not permitted after authorization, and the card verification code should not be retained once authorization is complete. So, the statement listing the allowed elements—name, PAN, expiration date, and service code—best reflects the correct practice.