PCI DSS and test data: no live card numbers in pre-production
PCI DSS v4.0.1 is explicit: live card numbers stay out of pre-production unless that environment is protected like production. And card numbers don't only sit in databases. They turn up in call transcripts, chat logs, dispute letters and scanned forms.
“Live PANs are not used in pre-production environments, except where those environments are included in the CDE and protected in accordance with all applicable PCI DSS requirements.”
No live PANs in pre-productionUnless the environment is inside the cardholder data environment and protected to the full standard.Requirement 6.5.5
Remove test data before go-liveTest data and test accounts are removed from system components before the system goes into production.Requirement 6.5.6
No sensitive authentication data after authorisationCard verification codes and PINs can't be kept after authorisation, even encrypted. That includes a code read out on a recorded call.Requirement 3.3.1 · PCI SSC FAQ 1210
Know where account data livesScope is confirmed at least every 12 months, including every place account data is stored. Mailboxes, documents and transcripts count.Requirement 12.5.2
Requirement 6.5.5 is about live PANs. Once a value is no longer a live card number, that requirement no longer applies to it, which is why replacements should keep the format so tests still pass. Confirm the approach with your QSA.
Which version of PCI DSS applies now?
Version 4.0.1. Version 4.0 was retired at the end of 2024, and the requirements that had been future-dated became mandatory on 31 March 2025.
What about card numbers read out on calls?
The card number in a transcript is account data like any other. Card verification codes must not be kept at all after authorisation. The PCI SSC FAQ on call recordings covers the detail.
This page summarises the rules for planning purposes. It is not legal advice; check how they apply to you with your counsel or DPO.
The platform underneath, in production
Documents run on the same platform banks and insurers already trust with their test data.
Documents and text use the same policies, the same engine and the same deployment as these results.
