PCI DSS in India: compliance for merchants, BPOs and service providers, with RBI, DPDP Act and CERT-In duties in view

Why organisations in India pursue PCI DSS

Three kinds of Indian business meet the request most often. Contact centres and BPOs in Mumbai, Pune, Bengaluru or the National Capital Region take card payments on behalf of US, UK or Australian brands, and the client's contract makes them a service provider inside its card data flow. Indian merchants accepting cards online or in stores hear it from their acquiring bank. Software and hosting firms serving global merchants meet it in enterprise security questionnaires.

In each case the obligation is contractual and renewed every year. The card brands set the rules and the acquirer or client enforces them; the mechanics of ROC, SAQ and AOC are covered in PCI DSS validation step by step.

Who validates PCI DSS compliance in India

PCI DSS is a validation route, so NABCB and other accreditation bodies play no part and there is no certificate to check on a national register. The PCI Security Standards Council qualifies QSA companies and approves the ASVs that run external scans. A QSA company may assess only in the regions or countries for which it is qualified, and the Council's QSA listing can be searched by place of business and region, with a separate list for ASVs. Check it each time you engage a firm, including any "In Remediation" status. Questions to put to a shortlist are in Choosing a QSA: what to ask before you sign.

Your acquirer decides your merchant level and whether it expects a ROC or an SAQ; card brands such as Visa and Mastercard set levels by annual transaction volume. Staff sponsored as Internal Security Assessors can test controls internally; whether an ISA-completed assessment is accepted is for your acquirer and the card brands.

Regulated financial entities carry a second layer. The Reserve Bank of India's 2026 cybersecurity and technology risk directions for commercial banks and for NBFCs, and its 2024 master directions on cyber resilience and digital payment security controls for non-bank payment system operators, set their own governance, testing and incident rules. They apply because of who you are, while PCI DSS applies because you handle card data. The RBI and SEBI cybersecurity frameworks page covers them.

Local practice that changes the project

Offshore contact centres and client-owned systems

Indian delivery teams often take payments on the client's telephony, CRM and payment page, inside a client network reached from an Indian floor. Agent desktops, call recordings, screen capture and the floor's own network each need a named owner in a written responsibility split. Recordings and screenshots must never hold sensitive authentication data after authorisation. Where you are the service provider, clients will ask for your AOC, which the Council intends to be shared with requesting entities under brand rules. PCI DSS for BPO and contact centres goes deeper.

The DPDP Act alongside the card data environment

Card data identifies a person. Where it relates to people in India, the Digital Personal Data Protection Act, 2023 requires reasonable security safeguards under section 8(5), and from May 2027 breach details go to the Data Protection Board of India within 72 hours under Rule 7 of the DPDP Rules, 2025. For data of people outside India processed under a foreign contract, section 17(1)(d) disapplies much of the Act, but not section 8(5). The wider programme sits in DPDP Act compliance for companies in India.

CERT-In directions and your logs

The CERT-In directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000 require listed incidents to be reported within 6 hours of noticing them, ICT logs kept for a rolling 180 days within Indian jurisdiction, and clocks synchronised to NIC or NPL time sources or sources traceable to them. Configure your PCI DSS logging and log review to meet these at the same time.

How Sterling works in India

Sterling runs Indian engagements from its Navi Mumbai office, on site across Indian cities or remotely. The team draws on an international practice of 8,100+ client engagements in 60+ countries since 2003. Sterling does not validate compliance; the QSA assesses and attests.

PCI DSS in India: questions buyers ask