thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Sensitive Authentication Data (SAD)

Card security data such as full track data, card verification codes, and PINs that must not be stored after authorization.

Definition

SAD includes full magnetic stripe or chip equivalent data, CVV2/CVC2/CID codes, and PINs or PIN blocks. Merchants cannot retain SAD after authorization even if encrypted; issuers may store it with a legitimate business need. Storing SAD is among the most serious PCI violations.

Example

A call center must ensure CVV2 values are not captured in call recordings.

Exam tip

SAD cannot be stored post-authorization even if encrypted.

Related terms