The Payment Card Industry Data Security Standard (PCI DSS) establishes high standards of cardholder data storage, processing, and transmission. Documentation that contains sensitive payment data, especially PDF files, is likely to be one of the most frequent dilemmas encountered by the company in complying with PCI DSS requirements. Contracts, invoices, receipts, and transaction records are all likely to contain cardholder information that should be heavily redacted before posting. Inadequate disposal of this type of data may lead to violations of compliance standards, penalties, and damage to their reputation.
This article discusses why redaction is important, the dangers of unsound handling, and best practices for safely redacting payment information from PDFs to stay PCI compliant.
Photo by Towfiqu barbhuiya from Unsplash
Why Payment Data Must Be Redacted
PCI DSS is intended to secure cardholder information, including the Primary Account Number (PAN), expiry date, and security codes. All these are defined as sensitive authentication data and should never be stored in a manner that is accessible to unauthorized parties.
Reports such as sales reports or receipts that are scanned usually include this information. If such PDFs are distributed to auditors, vendors, or internal staff without deleting cardholder information, then the organization will be non-compliant with PCI DSS. In addition to the risk of non-compliance, the disclosure of payment details can be used to commit fraud and identity theft, and diligent redaction is therefore not only a legal requirement, it is a moral one as well.
Typical Redaction Errors
Redaction may sound easy – just black out the figures, right? Most organizations get into pitfalls that result in the exposure of data, even though it might seem to be hidden. The most frequently made mistakes comprise the following:
- Use of black boxes or highlights. Visually overlaying a shape to cover card numbers does not actually remove the text. Anyone can copy-paste or extract the underlying data.
- Rasterizing to an image without stripping metadata. Even though rasterizing a page can cover up text, hidden info in layers or metadata may still exist.
- Not verifying backups and duplicates. There may be redacted duplicates, but in case unredacted originals are retained in shared folders or email stores, then the information is still vulnerable.
- Lack of uniformity in the method of redacting. Departments can employ ad hoc techniques that are inconsistent with other departments, and thus, compliance would be lacking.
Proper redaction involves not only concealing text but also erasing it from the digital structure of the document.
PCI DSS and Document Redaction Requirements
Although PCI DSS has not specified any specific tools used in redaction, it has made it mandatory that cardholder data must be protected wherever it is located. The requirements that are critical in regards to document redaction include:
- Requirement 3.2: Sensitive security authorization data should not be retained after authorization. This includes the CVV and entire data of the magnetic strip, which should never be in stored documents.
- Requirement 3.4: Encrypt primary account numbers such that they are unreadable anywhere they are stored. In the event of requirements for partial card numbers (such as on a receipt, the last four digits), be sure that truncation or masking is applied consistently.
- Requirements 9.6: Secure all media that holds cardholder data. Under PCI DSS, documents are “media,” so redacted PDFs need to be protected just like databases or paper documents.
For organizations, this translates into creating and implementing redaction processes to ensure that information that is sensitive is completely removed prior to documents being shared or archived.
Best Practices When Redacting Payment Information from PDFs
In order to comply with PCI DSS and steer clear of the traps of half-redaction, organizations must implement these practices:
- Use professional redaction software. General-purpose PDF viewers can permit annotations or blackout, but only specific redaction programs irretrievably remove sensitive information from the file infrastructure. A commercial program like PDFIZED redaction tool can overwrite the hidden text, sanitize the metadata, and make it impossible to recover the information.
- Check redactions carefully. Always test redacted documents by attempting to copy, search, or extract text. A proper redaction should leave no recoverable data. Verification should be built into the compliance workflow rather than left to assumption.
- Keep audit trails. For purposes of compliance reports, maintain documentation of when redactions took place, by whom, and with which process was applied. Most enterprise PDF redactors create logs that may be presented as audit evidence.
- Develop retention and disposal policies. Redaction is but half the equation. PCI DSS also mandates the minimization of data retention. Once a document ceases to serve a business or legal need, then it must be deleted securely and not kept in a redacted and retained format.
Example of Redacting Payment Data Safely
Let’s assume a company has to exchange transaction receipts with an outside auditor. This could work securely as follows:
- Get the receipts out of a centralized database instead of employee inboxes so that you do not lose any of the files.
- Run the PDFs through an auto-redaction program configured to remove anything but the final four digits of card numbers.
- Check the redacted versions to make sure no hidden information is left.
- The redacted versions are to remain in a closed folder with access only to the audit team.
- Permanently remove the existing unredacted files from all readily accessible storage facilities upon verification that backups are unnecessary.
This process achieves compliance and streamlining, and maintains a clear record of secure processing.
The Role of Training and Awareness
Technology by itself is insufficient. Document-handling staff need to be trained to identify sensitive information and be informed of correct redaction practices. Typical traps, including the use of basic drawing functionality to cover up numbers, are only prevented when staff are aware of the distinction between cosmetic obscuring and deletion of information. Ongoing refresher training correlated to updates of the PCI DSS ensures organizational discipline is kept current.
Now You Can Redact Sensitive Payment Data in PDFs Safely
Redacting the sensitive payment information in PDFs is not an optional step but a requirement of PCI DSS. Any organization that does not adequately destroy the cardholder data in a document must expect high financial losses as well as negative impacts on its reputation. Redaction is a skill that needs more than black boxes; it needs professional applications, automated security, role-based access, and training. Companies with secure redaction workflows built into their daily operations can significantly minimize this exposure, display compliance when undergoing an audit, and above all, ensure their customers are not exposed to fraud. A key facet of prudent data security in the world of digital commerce is effective redaction.
