Payment Cards, Customer Data and Records

Most owners learn about card rules when a processor sends a letter or adds a "PCI non-compliance" line to a monthly statement. By then the cheap fixes are already behind you. This lesson goes through taking cards, then the other records a shop holds: customer lists, employee files and the paper in the back office. Lessons 02 and 03 cover the logins and backups that protect all of it. The scams that try to pry payment data loose are in lesson 08.

Take cards without holding them

Every card sale involves a long chain: the customer, your terminal or web page, a processor or payment gateway, the acquirer (the bank that settles the money to you), the card brand and the customer's bank. Your goal is to be as short a link as you can. The fewer places a real card number passes through your own equipment, the fewer rules apply to you and the less a thief can steal from you.

Cardholder data is the card number (the PAN, for primary account number), plus the name, expiration date and service code if stored with it. PCI DSS also names sensitive authentication data: the full magnetic stripe or chip data, the three or four digit code printed on the card (CVV or CVC), and the PIN. That group may not be stored after a charge is authorized, even if you encrypt it. No business reason overrides this. If a staff member asks "can we just keep the code so we can bill again?" the answer is no, and a stored token gives them what they actually need.

These ways of taking a card keep numbers out of your files:

• Hosted payment page. Your website sends the customer to the processor's page, or shows the processor's form inside your page. The number goes from the customer's browser to the processor and never touches your web server.
• Terminal that encrypts at the swipe. A chip, tap or swipe reader from your processor, ideally on a validated point-to-point encryption (P2PE) list, scrambles the number before it reaches your network.
• Virtual terminal. A login on the processor's site where staff type in a phone or mail order. The keystrokes go to the processor's page, and nothing is saved on your computer.
• Tokens. If you bill customers again later (a monthly service, a deposit balance), the processor stores the card and gives you a token. A stolen token is useless anywhere else.

The common ways small shops get this wrong are boring. A clerk copies a card number on a sticky note "just until the manager runs it." A customer emails a photo of both sides of a card. A salesperson keeps a spreadsheet of phone orders. A restaurant's old paper slips with full numbers sit in a box in the basement. A shared computer at the counter doubles as the browsing machine. Each one turns a small shop into a place that holds card data.

PCI DSS on one plain page

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements written by the PCI Security Standards Council, a body formed by the card brands. The council writes the standard. It does not police you. The brands enforce it through your acquirer, which is why the paperwork arrives from your processor. Per the council's PCI DSS v4.0.1 announcement, v4.0 was retired on 31 December 2024, and the newer requirements that had a grace period became mandatory on 31 March 2025 (as of October 2026, v4.0.1 is the supported version).

Most of it comes down to this: the rules apply to anyone who stores, processes or transmits cardholder data, and they shrink when you hand those jobs to a validated provider. How you prove compliance depends on your size and your setup.

Merchant levels

The card brands sort merchants into four levels by how many transactions they run in a year. Visa describes level as a 12-month total of Visa credit, debit and prepaid transactions. The thresholds below are Visa's published tiers as summarized by a payment compliance vendor; Mastercard and others set their own, so your acquirer's letter is the final word.

A shop with 4 employees and a card terminal is nearly always Level 4. It does not get a pass from the rules. It validates the way its acquirer says, usually by completing the right questionnaire and, if it has a public-facing website or IP address in scope, a quarterly scan by an approved vendor. Visa also runs a Technology Innovation Program under which a merchant may skip annual validation if at least 75 percent of its transactions come through chip-enabled terminals, validated P2PE or approved tokenization, and it stores no sensitive authentication data. Your acquirer says whether you qualify.

Self-assessment questionnaires

An SAQ is a form with requirements matched to one way of taking cards. Picking the wrong one is the usual mistake. Eligibility summaries from the council's materials, as restated by a compliance publisher, run like this.

The council's small merchant page also lists free material: a Guide to Safe Payments, Common Payment Systems, Questions to Ask Your Vendors, a Data Security Essentials evaluation tool and PCI Firewall Basics. Read "Questions to Ask Your Vendors" before you sign for new equipment. The council adds that payment brands, not the council, decide whether a given small merchant must validate, so contact your acquirer.

Point-of-sale basics a bookkeeper can check

Your register, terminal, tablet and the router behind them are the place where card data is most exposed. The FTC's Protecting Personal Information guide says to secure and inventory PIN pads, change default passwords and use TLS for card data. The Small Business Administration advises isolating payment systems from general web browsing. Put that into a monthly check.

1. Keep a one-page list of every terminal and reader: make, serial number, where it sits and who services it.
2. Look at each terminal at open. Loose parts, new stickers, a changed cable or a slot that looks bulkier than yesterday's can mean a skimmer. Photograph a "normal" one to compare.
3. Lock terminals and tablets away overnight or tether them. Never leave a handheld reader on a counter in view of a window.
4. Change the admin password on every terminal and register the day it arrives. Defaults are public. Give the processor's remote support tool only the access it needs and turn it off when not in use.
5. Do not browse the web or read email on the register. A separate cheap computer or tablet for office work costs less than a day of downtime.
6. Ask the vendor how updates arrive and who installs them. A terminal that has not been updated in years is a risk in itself.
7. Put the register and terminals on their own network segment, apart from guest Wi-Fi and the office computers. Lesson 06 shows how.
8. Train every new hire on what to do if a customer hands over a card that looks tampered with or a caller asks for "your terminal ID" (a classic scam: callers pose as the processor and ask staff to read numbers aloud).

Customer lists

Cards are the headline, but a plain customer list is worth money to a thief: names, home addresses, phone numbers, email addresses and purchase history make good raw material for scam calls and fake invoices. The first step is the FTC's "take stock": find every place customer data sits. For a typical shop that is the point-of-sale system, the email program, the accounting package, a mailing-list tool, a spreadsheet someone made in 2019, the paper order book and the phones of sales staff.

Then cut. Do you need a birth date for a loyalty program? A copy of a driver's license for a sale? The FTC guide says not to collect sensitive data you do not need and to keep what you do need only as long as necessary. Limit who sees the full list, turn off bulk export for roles that do not need it, and make sure every vendor that holds the list (the email marketing service, the accounting package, the delivery app) is one you could name and one that offers two-step sign-in. Lesson 04 covers vendor questions in detail.

Employee records

Your own staff files hold the most dangerous data you have, because they combine a Social Security number with a bank account for direct deposit and a home address. They also draw scammers: a fake email "from the owner" asking the bookkeeper for every employee's W-2 is a staple of tax-season fraud.

• Social Security numbers. Use them only where a tax or benefit form requires. Never use them as an employee ID number or print them on badges, schedules, pay stubs or sign-in sheets.
• W-2 and payroll data. Let the payroll provider's portal do the work. Do not pass these files by ordinary email. Anyone asking for a bulk list gets a phone call back to a number you already know.
• Form I-9. The retention rule in 8 CFR 274a.2(b)(2)(i)(A) is three years after hire or one year after employment ends, whichever is later. Keeping them longer is a risk with no payoff.
• Payroll tax records. The IRS says to keep employment tax records for at least four years after filing the fourth-quarter return for the year. Some pandemic-era credit records need six.
• Bank details for direct deposit. A "please change my direct deposit" email is a common payroll diversion trick. Confirm by voice, in person, with a form on file.

Health and financial data in plain terms

Some businesses carry extra legal duties because of what they do, not their size. A medical or dental office, a lab, a pharmacy, or a firm that handles patient information for one is probably covered by federal health privacy law, and the Department of Health and Human Services (HHS) sets those breach rules. Businesses that do lending, collections, check cashing, wire transfers or similar financial work can fall under the FTC Safeguards Rule. That rule, at 16 CFR 314.4(j), requires a covered business to tell the FTC electronically as soon as possible, and no later than 30 days after discovery, when unencrypted information of at least 500 consumers was acquired without authorization. Section 314.2(h)(2) of the rule lists examples that include check cashing businesses, businesses that regularly wire money to and from consumers and mortgage brokers, and the rule defines a notification event in section 314.2(m) as the unauthorized acquisition of unencrypted customer information. If you are unsure whether you fall in a covered category, your trade association or your insurer's breach hotline can often say; module 73 covers these frameworks at greater depth.

Keep less: retention and disposal

A retention schedule is the cheapest data security control there is. A one-page table lists each kind of record, the shortest period you must keep it, the reason, who owns it and how it is destroyed. Whatever you destroy on schedule cannot be stolen later.

Ask your accountant or tax preparer for any other period tied to your industry, your state tax filings or your insurer's rules. Where a table cell says "your own decision" you choose the number and write it down. The point is to have an answer.

Disposal has two parts. For paper, the FTC guide says to shred, burn or pulverize, and to put shredders near copiers and workstations so people use them. For electronic media, deleting is not enough. The FTC's Disposal Rule at 16 CFR 682.3 requires anyone who holds consumer information for a business purpose to dispose of it with reasonable measures against unauthorized access, and gives examples: burning, pulverizing or shredding paper so it cannot practicably be read, destroying or erasing electronic media, or using a record destruction company after checking that it is competent. A copier or multifunction printer with a hard drive needs the same care when it leaves the building. Home-office staff are covered too.

Privacy notice basics and FTC Section 5

A privacy notice is a short page that tells customers what you collect, why, who else gets it (the payment processor, the email tool, the shipping company), how long you keep it and how to ask for deletion or a correction. Write it in plain words, put it on the website and at the counter or on the receipt if you take sign-ups there.

Section 5 of the Federal Trade Commission Act, 15 U.S.C. 45(a), declares "unfair or deceptive acts or practices in or affecting commerce" unlawful. In a data setting, the FTC reads that two ways. A deceptive practice is a promise you do not keep, such as "we never share your information" or "all data is encrypted" when it is not. An unfair practice is conduct that causes or is likely to cause substantial injury that people cannot reasonably avoid, with benefits that do not outweigh the harm. The FTC uses that standard for failures like leaving customer data exposed with no reasonable protection. The practical rule for a small shop: do not promise more than you do, and do what you promise. Module 73 goes further into the laws and standards that apply to different kinds of business.

Who does what

Questions and answers

Can I keep the last four digits and the expiration date?

Yes. PCI DSS allows storing parts of cardholder data if protected, and the last four digits are widely used for matching a charge to a customer. The security code, the PIN and the full magnetic stripe or chip data cannot be kept after authorization.

Is it all right to photocopy a customer's card for a deposit?

No. A copy puts the number, expiration date and often the code in your files. Take the deposit through the processor and keep a receipt.

Our staff take card numbers over the phone. What is the least risky way?

Use the processor's virtual terminal and type the number directly into it. Do not write it on paper or read it back loudly in a public space. Better still, send a payment link by text or email that the customer fills out themselves.

Our processor charges a PCI fee every month. Is that required?

Some processors charge a monthly fee that is described as a PCI program or non-compliance fee. The council does not set it. Ask your processor what the fee covers, what you need to file to avoid or end it, and where in their portal to find the questionnaire.

What counts as a "breach" under Idaho law?

Idaho Code 28-51-104 defines a breach of the security of the system as the illegal acquisition of unencrypted computerized data that materially compromises personal information. Good-faith acquisition by an employee or agent for the entity's purposes is not a breach as long as the information is not used or disclosed without authorization. Lesson 10 walks through what to do.

Do paper files count?

Idaho's definition covers computerized data, but the FTC's guidance and the Disposal Rule cover paper too, and a stolen box of folders still harms the same people. Treat paper the same way.

How often should the retention table be reviewed?

Once a year with the policy review in lesson 11, and any time you add a new tool that stores customer or employee data.

What do we do with old hard drives and copiers?

Wipe or destroy them before they leave the building, or have a destruction company handle them and get a receipt. A drive in a donated copier is a file cabinet someone else can open.

Hard questions

If I do everything right and a processor fails, am I off the hook?

For the card data itself, much of the responsibility sits with the provider, which is the point of moving card handling to a validated one. For your own customers and records you still hold the duty to notify under state law if your data was affected, and customers will still look at your name on the receipt. Keep your provider's contract and its security attestation on file.

The questionnaire is long. Can I just click "yes" to everything?

You attest that your answers are true. A false attestation can sink a claim with your processor after a breach, and the processor may pass fines to you. Answer honestly. If a question confuses you, ask the processor to explain or choose a simpler setup that makes the question disappear.

Is it unfair to expect a four-person shop to meet a standard written for banks and big retailers?

The council's own small-merchant materials say it intends the standard to scale, which is why the questionnaires differ so much by setup. A shop that hosts nothing and uses an encrypting terminal answers a few dozen questions. The expensive path is storing the data yourself, so the strongest advice is to avoid that path. Fees and paperwork can fall hardest on the smallest merchants, and that is a fair complaint. The remedy available to you is to choose the lightest valid setup.

Why not keep everything forever in case I need it?

Because every old record is a liability that grows. If a breach reaches five-year-old customer data you had no reason to hold, you owe notice for it, you answer for it and your insurer may care. Keeping the records the law requires and nothing more is both the legal and the cheaper course.

Does Idaho require me to tell the attorney general when I have a breach?

The 24-hour duty in Idaho Code 28-51-105 applies to agencies. The attorney general's office says commercial entities may notify it but are not required to. Residents are the ones who must be told when misuse has occurred or is reasonably likely.