Study: Companies continue to store forbidden data

The figures show that 71 per cent of European and US businesses keep verification codes, while 57 per cent store information from magnetic strips.

The research, commissioned by RSA, also found that most companies choose to keep customer credit card numbers (81 per cent) and expiration dates (73 per cent) on file.

“PCI DSS is very clear about forbidding the storage of sensitive authentication data, such as the full magnetic stripe and the PIN block and most merchants understand that continuing to retain this data will cause serious problems in their audit results,” said Jim Melvin, vice-president of marketing and security solutions at RSA, in a statement.

“While many have defined a compelling business reason [such as analysing for fraud] to keep credit-card data, these organisations then face the significant challenges of protecting the information,” he added.

More than a quarter of respondents said identity and access management, as well as data encryption, were the biggest problems when trying to secure credit-card details.

The research also found that half of businesses said cutting the risk of a data breach was the greatest driver for complying with the PCI DSS standard. This was closely followed by credit-card company pressure (43 per cent) and potential fines (37 per cent).

The PCI DSS compliance deadline for some organisations is 30 September.

The study surveyed 677 organisations.