Card data protection guidelines for API clients

The document categorises card data based on the degree of sensitivity from the security perspective. The guidelines enable you to adopt PCI-compliant card data protection practices and thereby protect yourself and your clients from the consequences of data breach.

Introduction

Contis is a PCI-DSS compliant organisation and guarantees adherence of all security standards for card data generation, processing, storage and transmission.

Contis offers API interfaces to clients and gives them access to confidential information for card processing. Hence, Contis strictly enforces security protocol on its API clients to protect them from the consequences of data breach, such as litigation, loss of money and reputation.

Contis has classified various data based on the level of confidentiality (Table 1, Table 2 and Table 3) and prepared a guideline (Table 4) on how to preserve the data privacy in the systems and prevent any data breach incident.

Contis recommends that every API client strictly follows the guidelines and contacts the Contis support team regarding any queries on data safety compliance.

Classification based on data sensitivity

HIGHLY SENSITIVE DATA

This type of data should not be stored anywhere in your system, even on an intermittent basis. The data should be processed in the real time as it is transmitted by Contis.

SENSITIVE DATA

This type of data should be stored in an encrypted form and rendered unreadable. The security keys and encrypted data should be stored in a highly secure area, controlled by authorised access.

GENERAL DATA

The non-confidential data is stored in normal format in your system, but still covered by industry-compliant data protection policy and not for public use.

Data like Card Status (Lost, locked, Active, Inactive, Suspended, Cancelled, Frozen, etc.), HOSC, SWEAR, Agreement (Terms & Conditions), Scheme features, Card Design features/program, Communication templates, etc.

PCI DSS

Payment Card Industry (PCI) is an autonomous body. It was set up by major card brands like VISA, American Express, MasterCard, Discover and JCB for world-wide adoption of Data Security Standards (DSS). The body frames and encourages adoption of regulations for safe processing, transmission and storage of card data. PCI DSS applies to all the merchants, processors, acquirers, issuers and service providers involved in the card payment processing. Payment brand and acquirers are responsible for enforcing the PCI DSS compliance.

Contis is bound by PCI DSS regulations and encourages you to adopt the best practices. See table 4 on what “not to do” and “to do” for card data protection in line with the PCI data safety norms.

Contis is bound by PCI DSS regulations and encourages you to adopt the best practices. See Table 4 on what “not to do” and “to do” for card data protection in line with the PCI data safety norms.

Cardholder data protection best practices