Data Protection Guidelines

The document categorises card data based on the degree of sensitivity from the security perspective. The guidelines enable you to adopt PCI-compliant card data protection practices and thereby protect yourself and your clients from the consequences of data breach.

Introduction

Solaris is a PCI-DSS compliant organisation and guarantees adherence of all security standards for card data generation, processing, storage and transmission.

Solaris offers API interfaces to clients and gives them access to confidential information for card processing. Hence, Solaris strictly enforces security protocol on its API clients to protect them from the consequences of data breach, such as litigation, loss of money and reputation.

Solaris has classified various data based on the level of confidentiality (Table 1, Table 2 and Table 3) and prepared a guideline (Table 4) on how to preserve the data privacy in the systems and prevent any data breach incident.

Solaris recommends that every API client strictly follows the guidelines and contacts the Solaris support team regarding any queries on data safety compliance.

Classification based on data sensitivity

Highly Sensitive Data

Sensitive Data

General Data

Data like:

• Card Status (Lost, locked, Active, Inactive, Suspended, Cancelled, Frozen, etc.)
• HOSC
• SWEAR
• Agreement (Terms & Conditions)
• Scheme features
• Card Design features/program
• Communication templates
• etc.

PCI DSS

Payment Card Industry (PCI) is an autonomous body. It was set up by major card brands like VISA, American Express, MasterCard, Discover and JCB for world-wide adoption of Data Security Standards (DSS). The body frames and encourages adoption of regulations for safe processing, transmission and storage of card data. PCI DSS applies to all the merchants, processors, acquirers, issuers and service providers involved in the card payment processing. Payment brand and acquirers are responsible for enforcing the PCI DSS compliance.

Solaris is bound by PCI DSS regulations and encourages you to adopt the best practices. See table 4 on what “not to do” and “to do” for card data protection in line with the PCI data safety norms.

Solaris is bound by PCI DSS regulations and encourages you to adopt the best practices. See Table 4 on what “not to do” and “to do” for card data protection in line with the PCI data safety norms.

Cardholder data protection best practices

To do:

• Destroy all authentication data after processing
• Use strong cryptography to render all stored cardholder data unreadable
• Confirm compliance of your payment terminals with PCI PIN
• Store security keys in a secure area in the system to prevent its misuse
• Understand entire card transaction flow to know where to implement appropriate security measures
• Notify concerned authority if you receive full card number (unmasked). If received by mail note the source and delete the mail from the system
• Wipe off the data from hard drive before disposing.
• Install latest anti-virus and update it regularly
• Store paper record of card payment (if necessary) in a secure place and destroy in authorised shredder when required
• Create strong user access passwords and change them regularly to prevent unauthorised access
• Carry out regular scrutiny of users log details to detect any unusual activity
• Encrypt transmission of cardholder data over Internet and Intranet

Not To do:

• Do not store authentication data (Table 1) even if encrypted after authorisation
• Do not store data of the track on the magnetic strip or the chip
• Do not store Card Validation Value (CVV) used to validate card-not-present status
• Do not place servers and other card storage devices in unsecured place
• Do not permit unauthorised access to secured data storage
• Do not print cardholder information when not needed. If required, ensure PAN is masked or truncated.
• Do not store payment card data in laptops, smartphones, PCs and other personal devices
• Do not send or receive any card data through email, SMS, private messenger services and social media
• Do not create paper records of card data, if not necessary
• Do not store cardholder data in the server connected to the Internet
• Do not use vendor-provided default usernames and passwords
• Do not store any card data, unless absolutely required

Consequences of Data Breach

• Termination of card processing privileges
• Loss of reputation of your brand
• Invite a forensic audit from compliance authority
• Face client litigation
• Take 90-120 days to implement remedial measures, which could throw your business out of gear