merchant-agreement

34
(b) you must not store the personal identifi cation number (PIN) or sensitive
authentication data after authorization (even if encrypted); and
(c) if you use a service provider who stores or transmits cardholder data, you are
responsible for ensuring the security of that data; and
(d) if we tell you that you must comply with the Payment Card Industry Data Security
Standards, you must , at your cost, successfully complete the protocols for PCIDSS
within the time frame stipulated by us or the card schemes. You acknowledge and
agree that if you fail to do so:
(i) we may terminate the merchant services; and
(ii) you are liable for any fi ne imposed upon us by the card schemes as a result of
your failure to comply; and
(iii) you are liable for any penalties which the card schemes levy in the event that
you suffer a card data compromise incident, and have not complied with the
PCIDSS Accreditation program; and
(e) you agree to comply with the 12 key requirements of PCIDSS as detailed in the NAB
PCIDSS brochure; and
(f) you agree that any software or hardware you purchase, create or otherwise utilise for
the purpose of selling goods or services online does not retain its original password
before installing a system on your network which is used for the acceptance of card
payments or other security parameters. You agree that all passwords are changed on
a regular basis; and
(g) you grant enduring right for NAB to contact any Service Providers that enable you to
acquire credit card transactions. This clause is limited to the purpose of determining
the extent of a data breach, assessing remedies for that data breach and assessing
the level of compliance with PCIDSS; and
(h) NAB is obliged to report all data breach events to card schemes, law enforcement
agencies and/or Australian regulators. You grant irrevocable and enduring consent
for NAB to release details of any such data breach to the aforementioned bodies; and
(i) if you have suffered a data breach:
(i) you must give NAB and its agents full access to your systems and databases to
facilitate a forensic analysis to ascertain:
(A) what card data has been compromised; and
(B) what weaknesses in the system permitted the unauthorised access to the
data base; and
(C) whether card data was created, deleted, altered, copied or manipulated in
any manner; and
(ii) if you use the services of any external Service Provider, you give NAB and its
agents full access to necessary outsourced components such as data bases and