PCI DSS Compliance for E-Commerce and Fintech in India: Guide

PCI DSS compliance in India is mandatory for every business that stores, processes, or transmits credit card, debit card, or prepaid card data. The Payment Card Industry Data Security Standard (PCI DSS) is a global security framework enforced by Visa, Mastercard, RuPay, and other card networks. For Indian e-commerce businesses, fintech companies, and payment service providers, non-compliance means fines up to $100,000 per month, loss of card acceptance privileges, and full liability for data breach losses. With PCI DSS version 4.0 now fully enforced since March 31, 2025, and RBI tightening digital payment security requirements, the compliance bar has moved higher. This guide covers the 12 PCI DSS requirements, the 4 compliance levels, SAQ types, certification costs in India, and how Indian regulations intersect with PCI standards.

What is PCI DSS?

PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards created by the PCI Security Standards Council (PCI SSC) to protect cardholder data during and after financial transactions. The PCI SSC was founded in 2006 by five major card brands: Visa, Mastercard, American Express, Discover, and JCB. Any organization worldwide that accepts, processes, stores, or transmits payment card information must comply with PCI DSS, regardless of size or transaction volume.

The standard is not a law passed by any government. It is a contractual requirement imposed by the card networks through acquiring banks. When a merchant signs a card acceptance agreement with a bank, that agreement includes a clause requiring PCI DSS compliance. Violate it, and the card brands can fine the acquiring bank, which passes those fines directly to the merchant, sometimes with additional charges. In practice, this contractual enforcement mechanism is more effective than most government regulations because it hits where it hurts: the ability to accept card payments at all.

PCI DSS 4.0: What Changed and Why It Matters

PCI DSS version 4.0 replaced the long-standing version 3.2.1. Released in March 2022, version 4.0 had a transition period where both versions were accepted. That transition ended on March 31, 2024, making v4.0 the only active standard. A second set of future-dated requirements became mandatory on March 31, 2025. If your business validated compliance against v3.2.1 and has not updated, you are no longer compliant.

The biggest shift in v4.0 is philosophical. Previous versions followed a rigid, checklist-based approach: do exactly this, in exactly this way. Version 4.0 introduces a customized approach alongside the traditional defined approach. The customized approach lets organizations meet the security objective of each requirement using alternative controls, as long as they can prove the alternative achieves the same level of protection. This is a significant change for mature security teams that have controls exceeding the minimum but structured differently than the standard prescribed.

Key Changes in PCI DSS 4.0

The 12 PCI DSS Requirements (Organized by 6 Goals)

The 12 PCI DSS requirements are the core of the standard. They are organized into 6 broad security goals, each containing 2 requirements. Every business handling card data must address all 12, though the depth of implementation varies by compliance level and the specific SAQ applicable to your business model. Understanding the structure helps you plan your compliance roadmap and budget effectively.

For e-commerce businesses in India, Requirements 6 (secure coding) and 11 (regular testing) tend to demand the most effort. Payment page scripts, third-party integrations, and API endpoints all fall under these requirements. If your Pvt Ltd company runs an online store, these two requirements will likely consume the largest share of your PCI DSS compliance budget.

PCI DSS Compliance Levels: Which One Applies to You?

Your PCI DSS compliance level determines how you validate compliance: through a Self-Assessment Questionnaire (SAQ) or a full Qualified Security Assessor (QSA) audit. The level is based on your annual volume of card transactions across all channels (online, in-store, phone orders). Card brands define the thresholds, and your acquiring bank assigns the level based on your reported transaction volume.

Most Indian e-commerce startups and small businesses fall under Level 4. If your D2C brand processes 500 card transactions a month, you are firmly in Level 4 territory. Do not let the word "compliance" intimidate you into thinking this requires a six-figure expenditure. Level 4 compliance through SAQ A (if you fully outsource payment handling) is the most straightforward path and can be completed in 4 to 8 weeks.

Large payment aggregators, fintech companies processing millions of transactions, and banking institutions fall under Level 1, which requires a full on-site assessment by a QSA. This is the most rigorous and expensive validation method, but it is proportionate to the risk these organizations carry.

Who Needs PCI DSS Compliance in India?

The simple rule: if your business touches card data at any point, PCI DSS applies. "Touching" includes storing card numbers in a database, processing card transactions through your server, transmitting card data to a payment processor, or even having a web page where a customer types their card number, even if it is in an iframe hosted by the payment gateway.

E-Commerce Businesses

Every online store that accepts card payments needs PCI DSS compliance. This includes Private Limited Companies running D2C websites, marketplace sellers using custom payment integrations, subscription-based services charging cards monthly, and SaaS platforms billing with stored card credentials. If you use a hosted payment page (Razorpay, PayU, or CCAvenue checkout page), your scope is reduced to SAQ A, but compliance is still required. If your site has a custom-built payment form that touches card numbers before sending them to the processor, you are looking at SAQ D and a significantly larger compliance burden.

Fintech Companies and Payment Aggregators

Payment gateways, payment aggregators, lending platforms that disburse to cards, and any fintech that processes or stores card data must comply. RBI's guidelines for Payment Aggregators and Payment Gateways (released in 2020, updated in 2024) explicitly require these entities to undergo annual security audits, and PCI DSS is the recognized standard for card-related security. Most fintech companies processing over 6 million transactions annually fall under Level 1, requiring a full QSA audit.

Banks and NBFCs

Card-issuing banks, acquiring banks, and NBFCs offering card-based products (credit cards, prepaid cards) are subject to PCI DSS as both issuers and acquirers. RBI mandates additional security requirements for these entities under its Master Directions on Digital Payment Security Controls.

POS Terminal Operators and Retailers

Physical retail businesses using POS (Point of Sale) terminals that accept card swipes, chip inserts, or contactless tap payments need PCI DSS compliance. The specific SAQ depends on the terminal type and integration model. Standalone terminals from PCI-validated providers have the simplest compliance path (SAQ B), while integrated POS systems connected to business networks require SAQ C or D.

Self-Assessment Questionnaire (SAQ) Types

The SAQ is how most Indian businesses validate PCI DSS compliance. Instead of paying ₹10 lakh or more for a QSA audit, Level 2 to 4 merchants complete the appropriate SAQ, which is a structured questionnaire covering the PCI DSS requirements applicable to their specific card data handling model. Picking the right SAQ saves time, money, and frustration. Picking the wrong one means either answering questions that do not apply to you or, worse, missing requirements that do.

For most Indian e-commerce businesses using Razorpay, PayU, CCAvenue, or Cashfree with a hosted checkout or redirect model, SAQ A is the correct choice. It has the fewest questions (22) and the lowest compliance cost. The moment your website has JavaScript that can affect the payment page or your server-side code touches card data before sending it to the processor, you move to SAQ A-EP or SAQ D, and the compliance effort multiplies by 5x to 10x.

PCI DSS Certification Process in India

PCI DSS is technically a validation, not a certification (you cannot get a "PCI DSS certificate" in the way you get an ISO certificate). However, the industry commonly uses the term "certification" to refer to successfully completing the validation process. Here is the step-by-step process for both SAQ and QSA paths.

Step 1: Determine Your Compliance Level and SAQ Type

Contact your acquiring bank to confirm your compliance level based on annual transaction volume. Identify the applicable SAQ type based on how your business handles card data. If you are unsure whether your integration model qualifies for SAQ A or requires SAQ A-EP, your payment gateway provider or a PCI consultant can help make the determination.

Step 2: Define Your Cardholder Data Environment (CDE)

Map every system, network segment, application, and process that stores, processes, or transmits cardholder data. Include all connected systems that could impact the CDE's security. This scoping exercise is critical because it determines which systems must meet PCI DSS requirements. Poor scoping is the number one reason compliance projects go over budget.

Step 3: Conduct a Gap Analysis

Compare your current security controls against the applicable PCI DSS requirements. Document gaps between what you have and what the standard requires. For Level 4 merchants on SAQ A, this gap analysis is typically straightforward (1 to 2 weeks). For Level 1 organizations heading into a QSA audit, the gap analysis phase takes 4 to 8 weeks and often reveals deficiencies in logging, access control, and encryption practices.

Step 4: Remediate Identified Gaps

Fix the gaps found in Step 3. Common remediation activities include upgrading TLS versions, implementing multi-factor authentication, deploying file integrity monitoring, establishing formal security policies and procedures, configuring centralized logging, and setting up an incident response plan. Remediation is where most of the budget goes, especially for Level 1 organizations.

Step 5: Complete the SAQ or QSA Assessment

For Levels 2 to 4: Complete the applicable SAQ honestly, attach supporting evidence, and submit it along with an Attestation of Compliance (AOC) to your acquiring bank. For Level 1: Schedule the on-site QSA assessment. The QSA will review policies, inspect systems, interview staff, test controls, and produce a Report on Compliance (ROC). A typical Level 1 QSA on-site assessment takes 5 to 15 working days.

Step 6: Complete Quarterly ASV Scans

Engage an Approved Scanning Vendor to perform external vulnerability scans on your internet-facing systems. Scans must be completed quarterly and produce a passing result. If the scan identifies vulnerabilities, remediate them and re-scan until the result is clean. ASV scans are required for all compliance levels.

Step 7: Submit Compliance Documentation

Submit your completed SAQ and AOC (or ROC and AOC for Level 1) to your acquiring bank and, if required, directly to the card brands. Maintain all compliance evidence for at least 12 months as it will be needed during the next annual validation cycle.

Cost of PCI DSS Compliance in India

PCI DSS compliance costs in India vary significantly based on your compliance level, current security maturity, and the complexity of your cardholder data environment. Here is a realistic breakdown based on current market rates from Indian QSA firms and security consultants.

The cost difference between SAQ A and SAQ D for a Level 4 merchant is stark: ₹50,000 versus ₹3 lakh or more. This is precisely why scope reduction matters so much. Moving from a custom payment integration (SAQ D) to a hosted checkout page (SAQ A) can save a small e-commerce business ₹2 lakh to ₹10 lakh annually. For fintech companies at Level 1, the QSA audit cost is a significant line item, but the alternative (non-compliance fines of $5,000 to $100,000 per month) makes the investment straightforward.

Businesses that already hold ISO 27001 certification typically save 30% to 40% on PCI DSS compliance costs because many security controls (access management, logging, incident response, risk assessment) overlap between the two standards. If you are planning both certifications, pursuing ISO 27001 first is the more cost-effective sequence.

PCI DSS vs ISO 27001: How They Compare

PCI DSS and ISO 27001 are the two security standards Indian businesses encounter most frequently. They are not competitors; they complement each other. But understanding the differences helps you decide which to pursue first and how to budget for both.

The practical overlap between PCI DSS and ISO 27001 is roughly 60% to 70%. Access control, logging and monitoring, encryption, incident response, risk assessment, and security policy requirements exist in both standards. If you implement ISO 27001 first, a significant portion of PCI DSS requirements are already addressed. The remaining PCI DSS-specific items (cardholder data masking, PAN storage rules, ASV scans, specific authentication requirements) are then layered on top as targeted additions rather than built from scratch.

Indian Regulatory Context: RBI and Payment Security

PCI DSS exists as a global card industry standard, but Indian businesses must also understand the domestic regulatory layer. The Reserve Bank of India has issued multiple directives on digital payment security that intersect with, supplement, and in some cases go beyond PCI DSS requirements.

RBI Master Directions on Digital Payment Security Controls (2021)

Issued in February 2021, these directions apply to all regulated entities (banks, NBFCs, payment system operators) that offer digital payment products. The Master Directions require a board-approved information security policy, regular security audits by CERT-In empanelled auditors, incident reporting to RBI within 6 hours of detection, and controls for mobile banking, internet banking, and card-based transactions. While the directions do not name PCI DSS explicitly, the security control requirements for card-based transactions are equivalent to PCI DSS standards.

RBI Guidelines for Payment Aggregators and Payment Gateways (2020)

Released in March 2020 and updated subsequently, these guidelines mandate that payment aggregators obtain RBI authorization and maintain minimum net worth requirements (₹15 crore for existing PAs, ₹25 crore for new applicants). Security requirements include PCI DSS compliance (explicitly referenced), annual security audits by CERT-In empanelled auditors, data storage only in India, and implementation of a comprehensive information security policy. Payment gateways, while not directly regulated under this framework, are required to follow equivalent security standards by their partner payment aggregators.

Payment and Settlement Systems Act, 2007 (PSS Act)

The PSS Act is the primary legislation governing payment systems in India. It gives RBI the authority to authorize and regulate payment system operators. Under the PSS Act, RBI can issue directions to any system participant regarding technology standards, security controls, and operational requirements. Non-compliance with RBI directions issued under the PSS Act can result in authorization revocation, fines, and criminal penalties.

Card-on-File Tokenization (RBI Circular, 2022)

RBI mandated that merchants cannot store actual card data (card-on-file) from October 1, 2022 onwards. All stored card data must be replaced with tokens issued by the card network. This directive directly reduces PCI DSS scope for merchants because tokenized data is not considered cardholder data under PCI DSS. If your business implemented RBI's tokenization mandate, your PCI DSS compliance burden is already lighter than it was before October 2022.

Common PCI DSS Compliance Mistakes

Compliance failures rarely happen because a business deliberately ignored security. They happen because of misunderstandings, shortcuts, and overlooked details. Here are the mistakes that Indian businesses make most frequently during PCI DSS compliance, along with how to avoid each one.

• Choosing the wrong SAQ type: A merchant using a JavaScript-based payment form on their own domain selects SAQ A instead of SAQ A-EP. The result: an incomplete assessment that does not cover the actual risks. Always confirm your SAQ type with your acquiring bank and payment gateway provider before starting the assessment
• Ignoring scope creep: Your CDE was well-defined 12 months ago. Since then, the development team added a new API endpoint, connected a CRM to the payment database, and gave the marketing team access to transaction reports. Each change potentially expanded your PCI DSS scope without anyone notifying the compliance team. Quarterly scope reviews are essential
• Treating compliance as an annual event: PCI DSS is a continuous obligation. The quarterly ASV scans, daily log reviews, and ongoing access control management are requirements that must be maintained year-round, not just during the annual assessment period. Organizations that "go dark" between assessments face painful catch-up periods and frequent failures
• Default credentials on internal systems: Requirement 2 specifically mandates changing all vendor-supplied defaults. Database admin passwords left at "admin123," default SNMP community strings, and factory-set router passwords are findings that appear in nearly 40% of first-time QSA audits
• Inadequate logging: Requirement 10 requires logging of all access to cardholder data, with automated anomaly detection and 12-month retention. Many businesses have logging enabled but do not review logs, do not alert on anomalies, and do not retain logs for the required duration. This is a frequent assessment failure point
• Skipping the internal vulnerability scan: External ASV scans are well-known, but Requirement 11 also requires internal vulnerability scans quarterly. Internal scans are often skipped or deprioritized because they are not submitted to the acquiring bank, but a QSA will check for them during a Level 1 audit
• No incident response plan: Requirement 12 requires a documented incident response plan that is tested at least annually. "We'll figure it out when it happens" is not a plan. The response plan must include specific roles, communication procedures, containment steps, evidence preservation, and notification timelines
• Not updating for PCI DSS 4.0: Organizations that validated against v3.2.1 and have not updated their controls for v4.0 requirements (enhanced MFA, e-commerce script monitoring, 12-character passwords, targeted risk analysis) are no longer compliant. The v4.0 future-dated requirements became mandatory on March 31, 2025

PCI DSS Compliance Checklist for Indian Businesses

Whether you are a Startup India-registered company launching your first e-commerce product or an established fintech firm processing millions of transactions, this checklist covers the essential steps for PCI DSS compliance in India.

1. Confirm compliance level: Verify with your acquiring bank whether you are Level 1, 2, 3, or 4 based on your annual card transaction volume
2. Identify your SAQ type: Map your payment integration model to the correct SAQ (A, A-EP, B, C, or D). If in doubt, consult your payment gateway provider
3. Define your CDE scope: Document every system, network segment, application, and process that touches cardholder data, plus all connected systems
4. Conduct a gap analysis: Compare your current controls against the PCI DSS requirements applicable to your SAQ type. Document every gap
5. Remediate gaps: Implement required security controls: firewalls, encryption, MFA, access controls, logging, anti-malware, and secure coding practices
6. Draft required documentation: Information security policy, data retention policy, incident response plan, network diagrams, and access control procedures
7. Train staff: Security awareness training covering phishing, social engineering, password hygiene, and data handling procedures. Document the training
8. Engage an ASV: Schedule your first quarterly external vulnerability scan and remediate any findings
9. Complete the SAQ or schedule QSA audit: Fill out the SAQ with supporting evidence, or coordinate the on-site QSA assessment for Level 1
10. Submit AOC/ROC to acquiring bank: Provide your Attestation of Compliance (and ROC for Level 1) to your acquiring bank and card brands as required
11. Establish ongoing compliance processes: Quarterly ASV scans, annual penetration testing, continuous log monitoring, regular access reviews, and annual reassessment

Summary

PCI DSS compliance in India is a non-negotiable requirement for any business that accepts card payments. The 12 requirements across 6 security goals provide a comprehensive framework for protecting cardholder data, and PCI DSS v4.0 has raised the bar with stronger authentication, expanded encryption, and enhanced e-commerce protections. For most Indian e-commerce businesses and startups at Level 4, compliance through SAQ A costs ₹50,000 to ₹2 lakh and takes 4 to 8 weeks. For Level 1 fintech firms and payment aggregators, the QSA audit investment of ₹10 lakh to ₹30 lakh is a fraction of the potential non-compliance penalties. Start by reducing your PCI DSS scope through hosted payment pages and tokenization, build your security foundation with ISO 27001 certification, and then validate PCI DSS against the reduced scope. Your card data security is a business enabler, not just a compliance checkbox.