Retail and e-commerce — PCI and DPDP compliance

Applicable regulations

• PCI DSS for card acceptance
• DPDP Act 2023 for consumer data
• CERT-In empanelled testing
• Payment-partner and card-network requirements

Common cybersecurity risks

• POS and checkout compromise, including skimming and Magecart
• Loyalty and CRM data exposure
• API abuse across marketplace and partner integrations
• Peak-season availability and fraud
• Inconsistent control across franchises and partners

Audit findings we typically see

• POS and store networks pulled into PCI scope
• Weak segmentation between retail and corporate
• Third-party script and integration risk
• Consumer data retained beyond need
• No release-aligned testing

Services required

• PCI DSS assessment
• DPDP privacy programme
• VAPT
• Web application security testing

Our engagement approach

• Scope. Map POS, e-commerce and loyalty data, and minimise PCI scope through segmentation.
• Assess. PCI and DPDP gap testing, plus VAPT.
• Remediate. Segmentation, consent and retention controls, with evidence.
• Sustain. Peak-season readiness and recurring testing.

Expected evidence

• POS and e-commerce scope diagram
• Segmentation validation
• Third-party script inventory
• VAPT reports with closure
• Consent and retention records

Deliverables

• PCI DSS readiness
• DPDP programme
• VAPT reports
• Peak-readiness plan