Payment Application Data Security Standards (PA DSS)

The PA DSS is derived from the Payment Card Industry Council that is an organization comprised of the major card brands to provide consistent and self-regulated data security for cardholder data processing. It applies to software vendors and others who develop applications that store, process, or transmit cardholder data as part of authorization or settlement, where these payment applications are sold, distributed or licensed to third parties.

Use of PA DSS compliant technology does not automatically make an entity PCI DSS compliant since the application must be implemented into a PCI DSS compliant environment and according to the PA DSS Standards.

Account data that consists of Cardholder Data plus Sensitive Authentication Date. Cardholder Data includes: (1) Primary Account Number; (2) Cardholder Name; (3) expiration Date; and (4) Service Code.

Sensitive Authentication Data includes: (1) Full magnetic stripe date or equivalent on a chip; (2) CA V2/CVC2/CVV2/CID; and (3) PINs/PIN blocks.