Sensitive authentication data (SAD)
The slice of card data that PCI DSS forbids merchants to keep after authorization, no matter how well it is encrypted.
PCI DSS sorts card data into two piles. The card number, cardholder name and expiry date may be stored if they are protected. Sensitive authentication data may not: the full track data from the magnetic stripe or its chip equivalent, the three- or four-digit verification code on the card, and the PIN or PIN block. These are precisely the values needed to clone a card or shop with it online, so they are meant to vanish the moment the issuer has answered.
For a security framework the rule is unusually blunt. Encryption doesn't help and business need is no excuse, issuers that genuinely require the data being the one exception. Assessors still find it year after year in log files, debug dumps and databases where somebody once printed the entire authorization request "just for now".