Sensitive Authentication Data (SAD)

Sensitive Authentication Data (SAD) is a category of payment card data defined by PCI DSS that includes data elements used to authenticate a cardholder and authorize a transaction, but which must never be stored after the authorization process is complete, regardless of whether the data is encrypted. The prohibition on storing SAD post-authorization is one of PCI DSS's most absolute requirements.

SAD includes three categories of data. The first is full track data, the complete contents of a card's magnetic stripe or the equivalent data on an EMV chip. This data contains everything needed to clone a physical card, which is why its post-authorization storage is strictly prohibited. The second is card verification codes, the CVV2 on the back of a Visa card, the CVC2 on a Mastercard, the CID on an Amex. These codes verify that the person making a payment has physical possession of the card and are not embossed on the card (making them harder to capture from a physical impression). Storing them would allow fraudsters to make card-not-present purchases without the physical card. The third is PINs and PIN blocks, the encrypted representation of a customer's personal identification number, used for debit card and chip-and-PIN authentication.

The critical regulatory distinction between SAD and Primary Account Number (PAN) data is timing: PAN may be stored after authorization (in encrypted form, with strong access controls), but SAD must be deleted once authorization is obtained. The authorization data served its purpose, it can no longer be retained, full stop.

PCI DSS v4.0.1 tightened SAD requirements further, mandating that any SAD stored prior to authorization (which may be temporarily retained in some processing flows) must now be encrypted and subject to defined retention and disposal policies.