--- title: 7 Ways PCI DSS and GDPR Overlap description: There are 7 ways the PCI DSS and GDPR overlap that can be taken advantage of to simplify compliance with both regulations. image: https://insights.comforte.com/hubfs/cf_blog_post1.jpg --- [![Hubspot_blog_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![cf_blog_post1](https://insights.comforte.com/hubfs/cf_blog_post1.jpg)](https://insights.comforte.com/killing-two-regulatory-burdens-with-one-stone-pci-dss-and-gdpr) [Dan Simmons](https://insights.comforte.com/author/dan-simmons) l Jun 14, 2018 l [GDPR](https://insights.comforte.com/tag/gdpr), [PCI DSS](https://insights.comforte.com/tag/pci-dss), [Data Protection](https://insights.comforte.com/tag/data-protection), [Compliance](https://insights.comforte.com/tag/compliance) # 7 Ways PCI DSS and GDPR Overlap ## How to kill two regulatory burdens with one stone ## Becoming [GDPR compliant](https://www.comforte.com/enterprise-data-protection/compliance/) can seem like a daunting task. So daunting in fact that some firms outside the EU are resorting to quick, albeit rather extreme fixes, like withdrawing from the EU market entirely or blocking all traffic from EU based IP addresses. Fortunately, there are other tricks to becoming GDPR compliant that don’t involve severing ties with an entire economic region. If your organization is already PCI compliant or even heading in that direction, then you may be further on your way to GDPR compliance than you thought. Many of the same processes and technology you’re using to protect cardholder data can be used for protecting personal data. Below is a list of overlapping requirements of PCI DSS and GDPR: ### 1. Identify sensitive data ![Data Discovery](https://insights.comforte.com/hs-fs/hubfs/Icons/Icons%202020/DiscoveryColor.png?width=100&name=DiscoveryColor.png)In order to protect sensitive data, the first step is to [figure out how much sensitive data you have and where you have it](https://insights.comforte.com/how-are-you-supposed-to-protect-sensitive-data-when-you-cant-even-locate-it?hsLang=en). This can be a particular challenge as many organizations, oftentimes even unwittingly, have sensitive data stored across databases, in the cloud, etc. without any centralized way of keeping track of it. ### 2. Reduce the amount of sensitive data ![Database](https://insights.comforte.com/hs-fs/hubfs/Icons/Icons%202020/DatabaseColor.png?width=100&name=DatabaseColor.png)If you’re storing sensitive data you don’t really need, you’d be better off just getting rid of it. Some organizations may find they are stuck in a catch 22 where they have data that they could use for business insights, so they'd like to hang onto it, however they're unable to analyze the data without compromising security. In some cases, tokenization can [enable analytics on protected data](https://insights.comforte.com/how-to-end-the-tug-of-war-between-data-analysis-and-data-security?hsLang=en). ### 3. Secure the data you keep ![data protection](https://insights.comforte.com/hs-fs/hubfs/Icons/Icons%202020/FormatEncryptionColor.png?width=100&name=FormatEncryptionColor.png) For the data you’d like to hold on to, you have to keep it protected. Under PCI DSS this is described as being "rendered unreadable," while GDPR uses the term "pseudonymisation." Most organizations will want to have a data protection strategy that includes a combination of [tokenization, encryption, masking, and other forms or cryptography](https://www.comforte.com/resources-detail/news/data-centric-protection-explained-weighing-the-different-protection-methods/), depending on the use case. ### 4. Limit Access ![Access Management](https://insights.comforte.com/hs-fs/hubfs/Icons/Icons%202020/UserNameColor.png?width=100&name=UserNameColor.png)Only the people who need to access sensitive data should be able to do so and those people should  be able to access only the data they need to do their specific job. Do not cut corners by allowing multiple people to use the same account to access sensitive data. There have already been [high profile fines](https://insights.comforte.com/one-year-later-what-were-the-biggest-gdpr-fines?hsLang=en) for exactly that mistake. ### 5. Log Access ![Access Management](https://insights.comforte.com/hs-fs/hubfs/Icons/Icons%202020/AccessMgmtColor.png?width=100&name=AccessMgmtColor.png)Keep logs of who accessed what data and when in order to discourage neglect and malfeasance, and so you can more easily identify the source in the event of a breach.   ### 6. Assess preparedness ![Compliance](https://insights.comforte.com/hs-fs/hubfs/Icons/Icons%202020/ComplianceColor.png?width=100&name=ComplianceColor.png)Regularly assessing your data security apparatus is not only common sense, it’s required by both the PCI DSS and GDPR and it’s the only way to keep up with the constantly changing threats to data security.   ### 7. Prepare to respond to data breaches ![Data Breach](https://insights.comforte.com/hs-fs/hubfs/Icons/Icons%202020/ThreatActorColor.png?width=100&name=ThreatActorColor.png)Develop a breach response plan that specifies who to notify, how to contain a breach, how to determine the source, and who at your organization is responsible for each of the above. Note that if sensitive data is in a protected state, meaning that attackers can't extract any exploitable information from it, then the data may be [out of scope](https://insights.comforte.com/3-benefits-of-taking-data-out-of-pci-audit-scope?hsLang=en). --- | Share this:  | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/killing-two-regulatory-burdens-with-one-stone-pci-dss-and-gdpr&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/killing-two-regulatory-burdens-with-one-stone-pci-dss-and-gdpr&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/killing-two-regulatory-burdens-with-one-stone-pci-dss-and-gdpr&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/killing-two-regulatory-burdens-with-one-stone-pci-dss-and-gdpr&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/killing-two-regulatory-burdens-with-one-stone-pci-dss-and-gdpr&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## Want to learn more? Wondering which articles of GDPR overlap with which PCI requirements? If so, click the button below to download our white paper "PCI DSS as a Foundation for GDPR Compliance." [![Download White Paper](https://no-cache.hubspot.com/cta/default/4026697/aea1fd18-c4e0-4e49-8af5-2f3ba7b8a21c.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/aea1fd18-c4e0-4e49-8af5-2f3ba7b8a21c) ### Related posts ![OpenAI’s GDPR Travails Demonstrate Need for Data Security-by-Design](https://insights.comforte.com/hubfs/comforte%20AG_blog%20post_AI.png) Apr 6, 2023 l [GDPR](https://insights.comforte.com/tag/gdpr) , [Data Protection](https://insights.comforte.com/tag/data-protection) , [Compliance](https://insights.comforte.com/tag/compliance) , [Big Data Analytics](https://insights.comforte.com/tag/big-data-analytics) , [AI](https://insights.comforte.com/tag/ai) ### [OpenAI’s GDPR Travails Demonstrate Need for Data Security-by-Design](https://insights.comforte.com/openais-gdpr-travails-demonstrate-need-for-data-security-by-design?hsLang=en) After several weeks of incredible growth, OpenAI has come in for a bumpy ride of late. First it revealed details of a data breach exposing a significant number of ChatGPT subscribers. Then the Italian data protection regulator (GPDP) became the... [Read more](https://insights.comforte.com/openais-gdpr-travails-demonstrate-need-for-data-security-by-design?hsLang=en) ![How to Stay Agile and Compliant with Format-preserving Protection for Analytics](https://insights.comforte.com/hubfs/Analytics%20on%20Red%20Button%20Enter%20on%20Black%20Computer%20Keyboard..jpeg) Aug 4, 2022 l [GDPR](https://insights.comforte.com/tag/gdpr) , [PCI DSS](https://insights.comforte.com/tag/pci-dss) , [Compliance](https://insights.comforte.com/tag/compliance) , [Big Data Analytics](https://insights.comforte.com/tag/big-data-analytics) , [CCPA](https://insights.comforte.com/tag/ccpa) ### [How to Stay Agile and Compliant with Format-preserving Protection for Analytics](https://insights.comforte.com/how-to-stay-agile-and-compliant-with-format-preserving-protection-for-analytics?hsLang=en) Cloud-based analytics offer a truly transformative opportunity for global organizations. By extracting insights from data, they are already helping companies better serve their customers, improve operational efficiencies and make better business... [Read more](https://insights.comforte.com/how-to-stay-agile-and-compliant-with-format-preserving-protection-for-analytics?hsLang=en) ![17 Countries with GDPR-like Data Privacy Laws](https://insights.comforte.com/hubfs/Int_Datenschutz_Strategie_1.png) Jan 13, 2022 l [GDPR](https://insights.comforte.com/tag/gdpr) , [Data Protection](https://insights.comforte.com/tag/data-protection) , [Compliance](https://insights.comforte.com/tag/compliance) , [CCPA](https://insights.comforte.com/tag/ccpa) ### [17 Countries with GDPR-like Data Privacy Laws](https://insights.comforte.com/countries-with-gdpr-like-data-privacy-laws?hsLang=en) GDPR wasn't the beginning and it certainly won't be the end. Strict data privacy legislation with extraterritorial applicability is appearing in more and more economies across the globe, meaning the list of “GDPR-free” havens is growing shorter by... [Read more](https://insights.comforte.com/countries-with-gdpr-like-data-privacy-laws?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### Germany comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Australia comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### USA comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Singapore comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026