Any business that takes card payments handles cardholder data, and PCI DSS does not stop applying when a device is retired. A payment terminal, a server, or a drive that once processed or stored card data has to be dealt with so that data cannot be reconstructed. This guide explains what PCI DSS expects when you dispose of payment devices and media, and how to retire them without leaving cardholder data behind.
PCI DSS requires that any media holding cardholder data be rendered unrecoverable before it is disposed of, so the data cannot be reconstructed, and that this be done when the data is no longer needed for business or legal reasons. In practice that means electronic media such as drives, servers and payment terminals must be securely erased to a recognised standard or physically destroyed, and any hard-copy materials destroyed, with evidence retained. The reason disposal falls squarely within PCI DSS is that a retired device does not forget the card data it handled. A payment terminal, or a server that stored cardholder data, still holds it after it leaves service, and passing that device on without rendering the data unrecoverable is exactly the kind of exposure the standard exists to prevent. Handling retirement as part of your PCI obligations, with certified destruction and records, is what keeps a business that takes card payments compliant to the end of the device's life. It is a core part of protecting financial and payment data.
PCI DSS is often thought of as a live-systems concern: securing the network, protecting stored card data, controlling access. But the standard follows cardholder data through its whole life, including the moment a device that touched it is retired. That end-of-life moment is easy to overlook precisely because the device is on its way out, and it is where a compliant business can quietly create a breach. This guide is about closing that gap.
It is not only the obvious card readers. Any device in the payment chain can hold cardholder data, and every one of them has to be dealt with at retirement.
The most visible devices are the payment terminals themselves: the PIN pads, card readers and point-of-sale units that customers tap and insert cards into. These handle cardholder data directly, and when they are replaced or decommissioned they cannot simply be thrown out or sent back without being cleared, because they may retain data and configuration that should not travel with them. But the payment chain is wider than the terminal. Servers and workstations that processed transactions, drives that stored cardholder data even temporarily, and backup media that captured it all sit within the scope of the standard, and all of them hold card data after they are retired.
This is where disposal breaches in card-handling businesses tend to originate: not from the terminal everyone remembers to handle, but from the back-office server, the old workstation, or the backup drive that quietly held cardholder data and was disposed of as ordinary IT. PCI DSS does not distinguish between a device that looks like payment equipment and one that does not; what matters is whether it held cardholder data. If it did, it has to be rendered unrecoverable before disposal. The practical implication is that retiring payment infrastructure has to start with knowing which devices touched card data, so none is disposed of as if it were harmless.
A plain-looking server that stored cardholder data is as much in scope as the card reader on the counter. The question at disposal is always the same: did this device hold cardholder data. If yes, it must be rendered unrecoverable and the disposal evidenced, whatever the device looks like.
Five steps take a payment device out of service in a way that satisfies PCI DSS and leaves you the evidence to show it.
Map the payment chain, terminals, servers, workstations, drives and backup media, and flag everything that processed or stored cardholder data. Scope is set by the data, so this inventory is what makes sure nothing in scope slips out as ordinary IT.
Securely erase electronic media to a recognised standard such as NIST 800-88, or physically destroy it where a wipe cannot be assured, so cardholder data cannot be reconstructed. This is the core PCI expectation at disposal.
Payment terminals may carry specific handling or return requirements from the acquirer or scheme as well as the data-destruction obligation. Clear the data and follow the applicable terminal-handling rules rather than assuming disposal is the same as for a laptop.
Move retired devices under a documented chain of custody from decommission to destruction, so there is an unbroken record of what left, when, and what happened to it.
Keep a certificate for each device recording what was destroyed and to what standard. PCI compliance is demonstrated, not assumed, so the records are as important as the destruction itself.
The cleanest way to stay compliant at end of life is to route retired payment devices through a destruction process that renders cardholder data unrecoverable to standard and certifies it, under chain of custody. Talk to our team about retiring payment infrastructure compliantly.
Every box that touched cardholder data is in scope. The forgotten ones are usually the back-office devices, not the terminal.
Compliance effort concentrates on live systems. The retired device, still holding card data, is where the attention runs out. Figures from named sources.
A business can pass its PCI assessment on its live environment and still create a cardholder-data breach at the loading dock, when a decommissioned server or a box of old terminals leaves the building with card data still on it. End of life is a blind spot because the effort and attention naturally sit with running systems, and a device on its way out feels like it has already left the perimeter, when in fact it is carrying cardholder data past it. The finance sector is consistently among the most breached, and the consequences of losing card data run from PCI penalties and scheme action to privacy penalties of $50M or more. Rendering cardholder data unrecoverable on every retired device, following the terminal-handling rules, and keeping the certificates is not extra work bolted onto PCI; it is the same obligation to protect cardholder data, honoured at the one moment it is easiest to forget. For any organisation handling payment and financial data, disposal is where compliance is either completed or quietly broken.
The questions card-handling businesses ask most about retiring payment devices compliantly.
Yes. PCI DSS follows cardholder data through its whole life, and requires that media holding cardholder data be rendered unrecoverable before disposal so the data cannot be reconstructed, once the data is no longer needed. Disposal is not outside the standard; it is the final point at which the obligation to protect cardholder data has to be met, on every device that held it.
Any device that processed or stored cardholder data. That clearly includes payment terminals and card readers, but also the servers, workstations and backup media in the cardholder data environment. Scope is defined by whether the device held card data, not by whether it looks like payment equipment, which is why back-office servers and old backup drives are so often the overlooked exposure.
A reset may not reliably render all data unrecoverable, and terminals often carry additional handling or return requirements from the acquirer or scheme. The safe approach is to render any cardholder data unrecoverable to a recognised standard, or physically destroy the media where a wipe cannot be assured, and follow the applicable terminal-handling rules, keeping evidence of what was done rather than trusting a reset.
Records that demonstrate the cardholder data was rendered unrecoverable: a certificate for each device recording what was destroyed and to what standard, ideally under a documented chain of custody from decommission to destruction. PCI compliance has to be demonstrable, so the disposal evidence is what lets you show an assessor that retired devices were handled correctly, not just that they were removed.
No. PCI DSS applies to any organisation that stores, processes or transmits cardholder data, which includes a wide range of merchants and service providers, not only large institutions. A small business that takes card payments handles cardholder data and has the same obligation to render it unrecoverable at disposal. The scale differs; the requirement to protect card data to the end of a device's life does not.
The decision to retire devices and the inventory of what held card data are yours. The secure destruction, chain of custody and certification are well suited to a service, because rendering media unrecoverable to standard and evidencing it is exactly what a data destruction provider does. Routing retired payment devices through that process gives you the destruction and the records in one step, which is what PCI compliance at disposal needs.
See how ITC renders cardholder data unrecoverable on retired terminals, servers, workstations and backup media, to a recognised standard, under chain of custody, with a certificate for every device.
Evidence for your auditor
Regulators do not ask whether you recycled the hardware. They ask what happened to the data on it, who handled it, and where the record is. ITC holds ISO/IEC 27001:2022 for information security alongside ISO 14001:2015, ISO 9001:2015 and ISO 45001:2018, and issues serialised documentation on every job so the answer is already written down.
