Skip to contentSkip to content
🇮🇳
Regional Benchmark

PCI Compliance in India

India is one of the world's fastest-growing digital payments markets, driven by UPI, RuPay, and international card networks. The Reserve Bank of India (RBI) mandates PCI DSS compliance for all card payment system participants through its various directives on Payment Aggregators and Payment Gateways.

Run PCI Benchmark →
920
Avg Audit Hours
annually
₹7800k
Avg Cost (INR)
≈ $93k USD
54/100
Avg Maturity
maturity score

RBI's guidelines on Storage of Payment System Data require that all payment system data of Indian customers be stored only in India. This data localisation requirement adds complexity to PCI DSS scoping for multinational organisations. The Digital Personal Data Protection Act 2023 (DPDP) introduces additional consent and breach notification obligations.

Top PCI-Active Industries in India

FintechE-CommerceBankingRetailHealthcare

Regional Compliance Context

RBI Payment Aggregator Guidelines
Payment aggregators must be PCI DSS compliant; annual compliance certificates required
Data Localisation Mandate
All payment system data of Indian users must be stored domestically
DPDP Act 2023
Digital Personal Data Protection Act requires consent management and breach notification within 72 hours
CERT-In Reporting
Significant cyber incidents must be reported to CERT-In within 6 hours under IT Amendment Rules 2022

Frequently Asked Questions

Is PCI compliance mandatory in India?

Yes, the Reserve Bank of India mandates PCI DSS compliance for Payment Aggregators, Payment Gateways, and all entities that store, process, or transmit card data. Non-compliance can result in suspension of payment processing licences.

How does data localisation affect PCI scope in India?

RBI requires all payment data of Indian users to reside in India. This means multinational organisations must either host data centres in India or use compliant cloud regions, adding to PCI DSS scoping complexity and cost.

How much does PCI compliance cost in India?

Indian organisations average ₹7.8M (~$93k USD) annually. Fintech startups typically spend ₹1.5M–₹4M; large banks and payment processors can exceed ₹30M. Cloud-based GRC automation platforms reduce costs significantly.

What are the CERT-In reporting requirements for card data breaches?

Under IT Amendment Rules 2022, any cybersecurity incident including card data breaches must be reported to CERT-In within 6 hours of detection. This is one of the strictest timelines globally and requires 24/7 incident response capability.

Run PCI Benchmark →Intelligence Dashboard →PCI DSS Guide →Cost Calculator →

Get Your India PCI Benchmark

See how your compliance programme compares to India industry averages.

Run Free Benchmark →