Credit Card Information Form Template for England and Wales

It's a document used to capture a payer's card details (card number, expiry date, cardholder name, and CVV) in order to process a payment, set up a recurring billing mandate, or hold a payment authorisation. In England and Wales, collecting card data triggers obligations under UK GDPR, PCI DSS, and the Payment Services Regulations 2017.

It is technically lawful but strongly discouraged. PCI DSS requires that any organisation collecting, transmitting, or storing cardholder data meets rigorous security standards. Paper forms present a high risk of data breach; most card scheme rules prohibit retaining the CVV on paper entirely. Digital forms with tokenisation are the industry standard and significantly reduce compliance risk.

PCI DSS Level 1 through Level 4 requirements apply depending on transaction volume. Key obligations include: never storing the CVV after authorisation, encrypting stored card numbers, restricting access to card data, conducting regular vulnerability scans, and completing an annual Self-Assessment Questionnaire. Non-compliance can result in card scheme fines and withdrawal of processing facilities.

Cardholders have the right to access the data held (subject access request), the right to erasure where data is no longer needed, the right to restrict processing, and the right to object to processing based on legitimate interests. The organisation must respond to access requests within one calendar month and must have a clear retention schedule for card data.

Where a consumer pays between 100 pounds and 30,000 pounds by credit card, section 75 of the Consumer Credit Act 1974 makes the card issuer jointly and severally liable for the supplier's breach of contract or misrepresentation. Collecting card information correctly ensures that transactions are linked to the correct cardholder and supports dispute resolution.

Yes, but only with the cardholder's explicit consent and under a tokenised system that replaces the full card number with a secure token. Storing raw card numbers beyond immediate processing is prohibited by PCI DSS. The form must explain clearly how stored payment credentials will be used and how the payer can withdraw authority for future charges.

Under the Payment Services Regulations 2017 (implementing the UK's retained version of PSD2), online card payments above defined thresholds require strong customer authentication (SCA), combining two or more of: something the cardholder knows, something they have, and something they are. Physical card information forms used for mail order or telephone payments may qualify for SCA exemptions but should be documented.

The minimum necessary period consistent with the purpose. For payment authorisation records, most organisations retain transaction evidence for six years to align with the Limitation Act 1980 and HMRC requirements. However, the actual card number and CVV should be destroyed or masked as soon as authorisation is obtained; long-term retention of full card details is prohibited by PCI DSS.