PCI Compliance requires that merchants properly protect credit card data. The difficulty with that requirement is that storing it onsite often requires expensive hardware and software upgrades. Tokenization provides an alternative to expensive on site storage and allows merchants to store all sensitive customer data remotely in a PCI Compliant environment, without spending money on any upgrades. IT Security expert Joel Dubin explains it well:
Credit card tokenization is a technology that enables a token to replace a credit card number in an electronic transaction. This token or reference number is meant to prevent the theft of the credit card number during electronic transmission and storage of a transaction. Since the reference number can't be used for transactions or fraudulent charges, there is little harm done if it's stolen.
Tokenization [can make] systems compliant without costly changes by using a 16-digit randomly generated number resembling a card number. The only numbers from the original card are it's last four digits, which become the first four of the token. Using only these four numbers, the token is still PCI compliant.
For credit card processing, merchants use a PCI compliant payment gateway, with a unique token associated with the information that was submitted to an off-site vault. This unique customer identifier can then be used to remotely initiate transactions and change or delete files. You can also enable credit card updates automatically to ensure the customer's information is never out of date. Using this technology, merchants can completely eliminate the need to store credit card information on site. Using tokens is not limited to storing credit card information. It can be used to store all sensitive customer information including banking account information, drivers license numbers, social security number, image documents, and just about anything else.