Failure Patterns, Disputes, Security and Official Sources
Card tokenisation, PCI DSS and payment data rules for Indian merchants (2026)
Why merchants may not store card numbers since 1 October 2022, how card-on-file tokens work, what PCI DSS means for a small business, the 2026 authentication rules and DPDP.
Since 1 October 2022, RBI rules have barred merchants and payment aggregators from storing customers' actual card data (the full card number, expiry date and similar credentials). Saved-card checkouts work through card-on-file tokenisation (CoFT): the card network or issuer gives a token that only works for your business, and you store the token, not the card. The RBI's Master Direction on Payment Aggregators (15 September 2025) repeats that card credentials shall not be stored in any database or server the merchant accesses. In addition, the RBI authentication directions in force from 1 April 2026 require two factors for digital payments, at least one dynamic; PCI DSS is the card industry's security standard that applies wherever card data is handled; and the Digital Personal Data Protection Act, 2023 brings consent and security duties for customer data, with most obligations applying from 13 May 2027. For a small business, the simplest compliant path is a hosted or tokenised checkout so that card data never touches your systems. This guide belongs to the failure patterns overview.
Card-on-file tokenisation in brief
| Point | What it means |
|---|---|
| Framework | RBI card-on-file tokenisation framework (September 2021), extended to issuer-level tokenisation in later circulars |
| Storage ban | From 1 October 2022, entities other than card issuers and networks may not store actual card data |
| What you may keep | Limited data for tracking or reconciliation, such as the last four digits of the card and the issuer's name |
| Customer consent | Tokenisation needs explicit customer consent and additional authentication |
| Token scope | A token works only for the merchant (and device or channel) it was created for |
| Cost | Tokenisation is handled by your gateway or PA; check whether any fee applies |
What this means at checkout. When a customer chooses "save card", your gateway requests a token from the network; next time the customer sees the last four digits and pays with the token after authentication. If your shopping cart plugin or old code stores card numbers, remove that function and purge stored data after taking advice.
PCI DSS for small merchants
PCI DSS (Payment Card Industry Data Security Standard) is set by the PCI Security Standards Council, a body formed by the card networks. Version 4.0 replaced 3.2.1, and its new "future-dated" requirements became mandatory from 31 March 2025; the current revision is 4.0.1. Acquirers and PAs require merchants to follow it to the extent they handle card data.
| Your set-up | Card data exposure | Typical PCI DSS effort |
|---|---|---|
| Card terminal from acquirer, no card data stored | Low | Follow acquirer's instructions; protect terminal from tampering |
| Hosted payment page or redirect | Low | Short self-assessment; keep website secure |
| Embedded fields from the gateway (iframe or SDK) | Low to medium | Self-assessment; protect page scripts |
| Your own server receives card numbers | High | Full controls; usually not sensible for an MSME |
Ask your PA which self-assessment questionnaire (if any) applies to you and whether it charges for non-compliance.
Authentication rules from 1 April 2026
The RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 (issued 25 September 2025) apply from 1 April 2026 to banks and non-bank payment system participants. In brief:
- At least two factors of authentication for digital payments, unless exempted; for payments other than card-present ones, at least one factor must be dynamic (unique to the transaction).
- Factors can include OTP, PIN, passphrase, tokens and biometrics.
- Issuers bear losses from their own non-compliance.
- Cross-border card-not-present checks have a later date (1 October 2026 for issuers).
For merchants, this mostly happens inside the gateway and the customer's bank. Make sure your checkout supports the authentication flows, and expect failed payments if it does not.
Payment data and DPDP
| Rule | What it means for merchants |
|---|---|
| RBI storage of payment system data (2018) | Payment system operators must store payment data in India; your PA handles this |
| DPDP Act, 2023 and DPDP Rules, 2025 | Consent, notice, purpose limitation, security safeguards and breach intimation for personal data. The Rules were notified on 13 November 2025; most substantive duties apply from 13 May 2027 |
| CERT-In directions (2022) | Reporting of certain cyber incidents within 6 hours by covered entities; check whether they apply to you |
Customer names, phone numbers, UPI IDs, addresses and order histories are personal data. Do not upload settlement reports with customer details to unvetted tools, and give staff access only to what they need.
Worked example: an online shop clean-up (illustrative)
A small online shop finds that its old checkout plugin logged full card numbers in an order notes field.
| Step | Action | Cost (illustrative) |
|---|---|---|
| 1 | Switch to the gateway's hosted checkout | Developer time: 1–2 days |
| 2 | Purge stored card data from database and backups after advice | Developer time; backup review |
| 3 | Rotate admin passwords; enable two-factor login | Free |
| 4 | Complete the PA's PCI DSS self-assessment | A few hours |
| 5 | Update privacy notice for DPDP readiness | Legal review |
Doing this in a week costs far less than a data breach, a chargeback wave or termination by the PA.
FAQ
Can I store the last four digits for customer service?
Yes, limited data such as the last four digits and the issuer name may be kept for tracking and reconciliation.
Does tokenisation apply to card terminals in my shop?
The storage ban is mainly about card-on-file for online and recurring payments. At terminals, card data is handled by the acquirer's device; do not write down or photograph cards.
Do I need a PCI DSS certificate?
Most small merchants complete a self-assessment for their acquirer rather than a full audit. Ask your PA what it requires.
Is UPI covered by tokenisation?
No; UPI does not expose card numbers. Protect UPI IDs and phone numbers as personal data.
Sources
- Reserve Bank of India — card-on-file tokenisation circulars, Master Direction on Payment Aggregators, Authentication Mechanisms Directions 2025, storage of payment system data
- PCI Security Standards Council — PCI DSS v4.0.1
- MeitY — DPDP Act and Rules
- e-Gazette of India — DPDP Rules notification of 13 November 2025
- CERT-In — incident reporting directions
