Due to the strict requirements surrounding the handling of credit card information in both paper and electronic formats, the University Archives requires departments to adhere strictly to certain procedures when transferring records containing credit card data to the Archives or Record Center.
Good business practice requires that full credit card numbers should not be retained any longer than immediate business needs dictate. As soon as the business need is satisfied, the middle eight numbers must be punched out. Such redacted records, containing only the first and last four digits of the credit card number, are not subject to the procedures listed below. These records may be treated like any other financial records.
If your department cannot avoid retiring old records containing full credit card numbers, the following procedures must be followed before they can be transferred to the Archives or Record Center:
Compliance with these procedures is essential due to the unique security requirements and retention periods related to credit card information. If you have any questions about the University Archives credit card procedures please contact Laura Edgar, Archivist for Records Management, at LauraEdgar@nd.edu.