Only card networks and issuing banks may get to tokenise data

Under the new norms, every online merchant processing transactions for customers will only have access to a 'tokenised' key linked with the consumer's cards instead of the entire card file.

via Economictimes