# Article 27 — Destruction, deactivation and revocation **Commission Delegated Regulation (EU) 2018/389 · binding · OJ L 69, 13.3.2018 · dated 27 Nov 2017 [in force]** *In force · Consolidated version of 12 September 2023 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02018R0389-20230912)* Payment service providers shall ensure that they have effective processes in place to apply each of the following security measures: **(a)** the secure destruction, deactivation or revocation of the personalised security credentials, authentication devices and software; **(b)** where the payment service provider distributes reusable authentication devices and software, the secure re-use of a device or software is established, documented and implemented before making it available to another payment services user; **(c)** the deactivation or revocation of information related to personalised security credentials stored in the payment service provider's systems and databases and, where relevant, in public repositories. **CHAPTER V — COMMON AND SECURE OPEN STANDARDS OF COMMUNICATION** **Section 1 — General requirements for communication**