Primary Account Number (PAN) identifies the issuer and the cardholder account; this data is categorized as which?

• A. Card Holder Data (CHD)/PCI data
• B. Personal Data
• C. Protected Health Information
• D. Electronic Health Records

Answer: (A)

PAN is categorized as Cardholder Data (CHD) under PCI DSS. Cardholder Data refers to the payment card details that identify the cardholder and the account, including the PAN along with the cardholder’s name, expiration date, and service code. This classification exists to ensure PCI protections—strong controls for storage, processing, and transmission of card information such as encryption and access restrictions. It isn’t healthcare data (Protected Health Information or Electronic Health Records) or simply Personal Data, which fall under different privacy frameworks. So, PAN falls squarely into Cardholder Data (CHD) within PCI data categories.