Which uk gdpr principle is most relevant when considering how long we keep data for

UK GDPR covers retention; meeting UK GDPR needs a clear retention policy.

When was PCI DSS launched

PCI started in 2004 and targets payment system threats.

How do PCI DSS and GDPR overlap?

PCI vs GDPR overlap is the relationship between the payment standard and UK data law. PCI protects cardholder data technically. UK GDPR adds lawful basis, subject rights and retention rules.

Is PCI DSS sufficient for GDPR compliance?

No — the clear recommendation is to treat both as separate obligations and follow a dual approach.

How PCI and UK GDPR Overlap — Practical Steps for SMEs

Table of Contents

Frequently Asked Questions

Yes — if your SME accepts card payments and processes or stores personal data of UK/EU residents, both regimes apply. PCI DSS governs the security of cardholder data for payment card schemes, while UK GDPR governs personal data privacy and lawful processing. Practical steps: map where cardholder and personal data flow, avoid storing card data where possible (use tokenization), maintain PCI compliance (SAQ or QSA as needed), and keep GDPR records (RoPA), lawful-basis documentation, and appropriate technical/organizational measures.

PCI DSS can help demonstrate technical and organizational measures required by GDPR (for example, encryption, access controls, logging), but it is not sufficient by itself. GDPR also requires lawful basis, transparency (privacy notices), data subject rights, data protection impact assessments (DPIAs) for high-risk processing, and data processing agreements. For SMEs: treat PCI controls as part of your GDPR security evidence, and separately document GDPR-specific obligations (consents, DPIAs, RoPA, retention schedules).

What should my SME do about breach notification if card data and personal data are involved?

Follow both regimes: under UK GDPR you must notify the ICO within 72 hours of becoming aware of a personal data breach unless it’s unlikely to result in risk to individuals, and you must inform affected individuals when there’s high risk. For PCI incidents, notify your acquiring bank and relevant card brands immediately and follow their incident response requirements. Practical SME checklist: activate an incident response plan, contain the breach, preserve logs, notify your acquirer and the ICO within legal timeframes, and prepare communications for customers.

Keep data only as long as necessary for the purposes you documented (data minimization principle). PCI DSS forbids storage of sensitive authentication data after authorization (e.g., full magnetic stripe, CVV) and limits retained cardholder data to what’s needed (card number, expiry) with protections (encryption/formatted storage). For SMEs: define retention periods in your retention policy (e.g., invoices for accounting, statutory periods), justify each period in your RoPA, securely delete or tokenise card data when no longer required, and document business need and legal basis for retention.

Control area	PCI DSS	UK GDPR	Overlap & SME action
Encryption & data-at-rest protection	Requires strong cryptography for stored cardholder data and transmission	Requires appropriate technical measures (encryption advised for personal data where risks exist)	Use PCI-approved encryption to satisfy both; ensure key management, document encryption decisions in DPIA/RoPA
Access control & logging	Strict access controls (need-to-know), unique IDs, logging of admin access	Data minimization and integrity; logs help demonstrate accountability and detect breaches	Implement role-based access, multi-factor auth, retain logs for investigations and ICO evidence; review access regularly
Data retention & deletion	Prohibits storing sensitive authentication data post-authorization; minimizes stored card data	Requires retention limitation and lawful basis for processing; data subject rights (erasure)	Create retention schedule mapping PCI and legal accounting needs, tokenise instead of storing PAN, implement secure deletion procedures
Breach response & notification	Requires incident response plan, notify acquirer/card brands per their rules	Notify ICO within 72 hours; inform affected individuals if high risk	Maintain a unified incident response plan that covers immediate PCI reporting to acquirers and GDPR notification obligations to ICO/customers

Peter White

With over 12 years of experience helping UK small and medium-sized businesses navigate the world of cyber insurance, this author is passionate about guiding companies through complex risks and protection strategies. Combining practical knowledge with real-world insights, they provide clear, actionable advice on choosing, managing, and comparing cyber insurance policies. Every article on Cyber Insurance for UK SMEs is crafted to empower business owners, improve their security posture, and ensure they make informed, confident decisions to protect their company’s future.

Disclaimer: This article is for general informational purposes only and does not constitute financial, insurance, legal or cybersecurity advice. Cyber insurance suitability, coverage and pricing vary depending on business size, sector, systems and risk profile. UK SMEs should seek advice from FCA-authorised insurance professionals or brokers before making any insurance or risk management decisions. Information is based on publicly available UK guidance and market practices at the time of writing and may change.