Requirement 3 of PCI DSS v4.0 sets one job: protect stored account data. Req. 3.2.1 draws the line underneath it — account data may not sit on file longer than a legal, contractual, or genuine business reason justifies, and whatever outlasts that reason must be provably destroyed. UK GDPR Art. 5(1)(e) reaches the same conclusion from the privacy side: personal data is kept no longer than the purpose needs. DPA 2018 s.3(2) is the test for whether a cleaned copy still counts as personal data at all. anonym.plus applies all three on your own device, so the record stays useful while the sensitive part goes.
When this applies
A card issuer authorised by the FCA exports a support ticket that quotes a customer's full number verbatim. That verbatim quote is exactly what Req. 3.2.1 says should not be sitting on a support system past its retention reason. You strip those digits before the ticket is filed or forwarded.
How anonym.plus handles it
- Open the export in anonym.plus on your workstation.
- Local OCR reads any scanned slip attached to it.
- The tool flags long numbers, names, and contacts.
- Check each flag and clear a false hit by hand.
- Replace each value with a label, or black it out.
- Save the clean copy. The source never leaves your machine.
What you need to provide
- The export (PDF, CSV, DOCX, or TXT).
- An operator: Replace (swap), Redact (black out), or Mask (partial).
- Optional: a name map if you must re-link a customer later.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Account | CREDIT_CARD | 4111 1111 1111 1111 → [CARD] |
| Names | PERSON | Olivia Carter → [HOLDER] |
| Contact | EMAIL_ADDRESS | o.carter@example.co.uk → [EMAIL] |
| Bank | UK_BANK_NUMBER | a/c 12345678 → [ACCOUNT] |
| Contact | PHONE_NUMBER | +44 20 7946 0958 → [PHONE] |
| Amount | MONEY | £1,240.00 → [AMOUNT] |
Compliance achieved
- Limits stored account data to what a retention reason justifies, as PCI DSS v4.0 Req. 3.2.1 requires.
- Matches the storage-limitation duty in UK GDPR Art. 5(1)(e): kept only as long as the purpose needs.
- Tests the cleaned copy against the identifiability threshold in DPA 2018 s.3(2).
- Working copies are kept safe with AES-256-GCM.
- Covers 340+ PII types, well beyond the card fields alone.
Anonymise cardholder records offline — see plans & start free →
Limitations & cautions
The tool flags the named fields, but it cannot judge when a free-text note re-identifies a customer. Review narrative comments yourself before you release the file.
Frequently asked questions
Which data does Requirement 3 limit, and for how long?
It limits how a stored primary account number is kept, and Req. 3.2.1 requires a defined retention period with provable destruction once that period passes. anonym.plus flags the full value so you can mask or remove it before the retention reason expires, or before the file is shared at all.
Does the source ever leave my device?
No. Work runs on your own machine with no cloud step. Nothing is uploaded, so the account data stays where you control it. That also keeps the working copy inside UK GDPR Art. 5(1)(e)'s storage-limitation principle rather than creating a second, unmanaged retention record.
Will the record still read correctly after the swap?
Yes. The Replace operator drops a steady label in place of each value, so the text still flows and no longer names a real account. Under DPA 2018 s.3(2), whether that output still counts as personal data depends on whether anyone could reasonably re-link it — keep that test in mind before you treat a labelled copy as anonymous.