Buoyed by the festival season euphoria, credit card transactions for the first time crossed INR 1 Lakh Crore in October 2021 and debit card transactions were upwards of INR 7.5 Lakh Crore during the same period. With such exponential growth in cashless payments, information security and privacy of cardholder data is of utmost importance. Ever wondered how it is managed? What are the guidelines regarding data security for card based transactions? How does an entity comply with these guidelines? That’s where PCI DSS requirements come into play. 

So what is PCI DSS? Who formed these standards? What requirements does it prescribe? And who is responsible for adherence to these requirements? We will respond to these questions below:

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store or transmit card information maintain a secure environment for processing transactions. PCI DSS was developed to encourage and enhance cardholder data security, as well as to facilitate the global adoption of consistent data security measures. Payment Card Industry Security Standard Council (PCI SSC), an independent body created by Visa, MasterCard, American Express, Discover and JCB to standardise and improve account security throughout the transaction process, launched PCI DSS in September 2006; the latest version was debuted in May 2018.

PCI DSS applies to all payment card processing entities, including merchants, processors, acquirers, issuers and service providers. It also applies to any other entity that stores, processes or transmits cardholder data or sensitive authentication data.

12 Standards of PCI DSS

PCI DSS specifies 12 standards to which all entities must adhere. The following is an overview of these standards:

Let’s delve deeper into each standard to better understand the goal:

Install and maintain a firewall configuration to protect cardholder data

A firewall is a network security system that monitors and controls network traffic, both incoming and outgoing. Firewalls prevent foreign or unknown entities from accessing private data. These anti-hacking systems are frequently the first line of defence against hackers. Because of their effectiveness in preventing unauthorised access, firewalls are required for PCI DSS compliance.

PCI SSC provides a detailed step-by-step process for configuring and maintaining a firewall.

Do not use vendor-supplied defaults for system passwords and other security parameters

 Routers, modems, POS systems and other third-party products frequently include generic passwords and security measures that are easily accessible to the general public. Businesses frequently fail to secure these vulnerabilities. Before installing a system on a network, businesses must change the vendor-supplied default passwords and remove or disable any unnecessary default accounts.

Keeping a list of all devices and software that require a password is one way to ensure compliance in this area (or other security to access). In addition to a device/password inventory, basic precautions and configurations should be carried out on a regular basis. (For example, changing the password). 

Protect Stored Cardholder Data

The third PCI DSS compliance requirement is two-way data protection for cardholders. Cardholder data protection methods such as encryption, truncation, masking and hashing are critical components. If an intruder gets around other security measures and gains access to encrypted data, the data is unreadable and unusable to that person without the proper cryptographic keys.

The PCI SSC recommends that entities implement data retention and disposal policies to keep cardholder data storage to a minimum. It also requires entities not to store the card verification code or value (a three- or four-digit number printed on the front or back of a payment card that is used to verify card-not-present transactions) after authorization. That is why CVC/CVV is required to be entered by the customer every time an online transaction is made.

Furthermore, when PAN (Permanent Account Number or Card Number) is displayed, entities must mask it (the first six and last four digits are the maximum number of digits to be displayed), so that only personnel with a legitimate business need can see more than the first six/last four digits of the PAN.

To further prevent entities from storing cardholder data, the RBI has mandated tokenization for all card-based transactions. No entity in the card transaction / payment chain, other than card issuers and / or card networks, shall store the actual card data beginning January 1, 2022.

Encrypt Transmission of Cardholder data across open, public networks

Cardholder data is transmitted via multiple channels (i.e., payment processors, home office from local stores, etc). Malicious individuals continue to target misconfigured wireless networks and vulnerabilities in legacy encryption and authentication protocols in order to gain privileged access to cardholder data environments. When this data is transmitted over networks, it must be encrypted. PCI SSC defines cryptographic algorithms, keys and certificates for use in encryption.

Protect all systems against malware and regularly update anti-virus software or programs

Malicious software, also known as “malware,” including viruses, worms and Trojans, enters the network through a variety of business-approved activities such as employee e-mail and Internet use on mobile computers and storage devices, resulting in the exploitation of system vulnerabilities. To protect systems from current and evolving malicious software threats, antivirus software must be installed on all systems that are commonly infected by malware. Furthermore, all antivirus software must be updated on a regular basis, and an audit log must be kept.

Develop and maintain secure systems and applications

To protect against the exploitation and compromise of cardholder data by malicious individuals and software, all systems must have all necessary software patches. All software and applications must be updated on a regular basis with security patches to address system vulnerabilities.

Restrict access to cardholder data by business need to know 

To ensure that only authorised personnel have access to critical data, systems and processes must be in place to limit access based on need to know and job responsibilities. All employees, executives and third parties who do not require access to this information should not have it. The roles that require sensitive data should be well-documented and updated on a regular basis.

Identify and authenticate access to system components

 Individuals with access to cardholder data should have their own credentials and identification. For example, there should not be a single login to the encrypted data with multiple employees having access to the username and password. By assigning a unique identification (ID) to each person with access, you ensure that each individual is held individually accountable for their actions. When such accountability is in place, critical data and system actions can be traced back to known and authorised users and processes. In the event that data is compromised, unique IDs reduce vulnerability and speed up response time.

Restrict physical access to cardholder data

Any cardholder information must be physically stored in a secure location. Data that is physically written or typed, as well as data that is stored digitally (e.g., on a hard drive), should be kept in a secure room, drawer or cabinet. Not only should access be restricted, but any time sensitive data is accessed, a log should be kept to ensure compliance.

Track and monitor all access to network resources and cardholder data

Logging mechanisms and the ability to track user activities are critical in preventing, detecting and mitigating the effects of a data breach. When something goes wrong, the presence of logs in all environments allows for thorough tracking, alerting and analysis. Without system activity logs, determining the cause of a compromise is extremely difficult, if not impossible.

Regularly test security systems and processes

All ten of the preceding compliance standards involve a variety of software products, physical locations, and, most likely, a few employees. Many things can break down, become out of date or suffer from human error. These threats can be mitigated by complying with the PCI DSS requirement for regular system and process scans and vulnerability testing.

To ensure that security controls continue to reflect a changing environment, system components, processes and custom software should be tested on a regular basis.

Maintain a policy that addresses information security for all personnel

For compliance, an inventory of equipment, software and employees with access must be documented. Access to cardholder data logs will also necessitate documentation. The flow of information into a company, where it is stored and how it is used after the point of sale must all be documented. 

A strong security policy establishes the security tone for the entire organisation and informs employees of what is expected of them.

Levels of PCI DSS

In addition to adhering to these standards, organisations must assess and submit a Report on Compliance (RoC) based on the number of transactions handled each year:

• Level 1: Merchants who process more than 60 Lakh card transactions per year
• Level 2: Merchants who process 10 Lakh to 60 Lakh transactions per year
• Level 3: Merchants who process between 20,000 and 10 Lakh transactions per year
• Level 4: Merchants with fewer than 20,000 transactions per year

The assessment for Level 1 merchants should include an external audit performed by a QSA (Qualified Security Assessor) or ISA (Internal Security Assessor). They will conduct an on-site evaluation of the organisation in order to:

• Validate the scope of the assessment
• Review your documentation and technical information
• Determine whether the PCI DSS requirements are being met
• Provide support and guidance during the compliance process
• Evaluate compensating controls

To demonstrate compliance, the auditor will then submit a RoC to the organization’s acquiring banks. 

To confirm compliance with PCI DSS requirements, Level 2 merchants must only submit a self-assessment questionnaire (SAQ) and a self declared ROC rather than an external audit.

Level 3 and 4 merchants are only required to fill out a self-assessment questionnaire (SAQ).

Benefits of PCI DSS Compliance

At the very least, complying with PCI Security Standards appears to be a daunting task. The tangle of standards and issues appears to be too much for even large organisations, let alone smaller businesses. However, compliance is becoming more important and may not be as difficult as one might think, especially with the right tools. The following are some of the advantages of being PCI DSS compliant:

• Your systems are secure, and your customers can put their sensitive payment card information in your hands; trust breeds customer confidence and repeat businesses.
• It prevents data breaches. Each PCI-compliant business represents a less valuable target for cybercriminals. They will not only have a much more difficult time hacking your network, but they will also not find the data they are looking for!
• Comply with global data security standards. The PCI DSS regulations were initiated by five of the world’s leading credit organisations in order to provide consumers with a mandatory level of protection by ensuring that merchants meet minimum levels of security when they store, process, and transmit cardholder data. Obtaining PCI compliance allows you to join the ranks of other international businesses dedicated to data security and consumer protection.

Non-compliance with these standards will result in fines imposed by the networks on acquiring banks, which will then be passed on to the organisation in question. Repeated violations may result in the merchant’s ability to accept payments using their cards being revoked entirely.

In a world that has moved to the internet and the mobile, data privacy is paramount. This is more evident in financial services. As India embraces digital financial services, the volume of sensitive consumer data has soared. Protecting this data is essential not only for regulatory compliance but also for building and maintaining consumer trust. Robust data privacy practices prevent financial crimes such as identity theft and fraud, ensuring the integrity of financial systems, and the security of customers.

The Significance of Data Privacy in Indian Fintech

The digital transformation of financial services in India has led to an explosion in the amount of sensitive consumer data being collected, processed, and stored. Ensuring the privacy and security of this data is vital for maintaining consumer trust and preventing financial crimes such as identity theft and fraud.

Challenges in Prioritising Data Privacy While Fostering Innovation

Regulatory Compliance: The Digital Personal Data Protection Bill, 2023, aims to provide a robust framework for data protection. Fintech companies must navigate these regulations, requiring significant expertise and resources to ensure compliance without stifling innovation.

Data Security: With rising cyber threats, fintech firms must prioritise data security. Implementing advanced security measures like encryption, multi-factor authentication, and regular security audits is crucial to protect consumer data from breaches.

Transparency and Consent: Consumers are increasingly concerned about data usage. Fintech companies must ensure transparency in their practices and obtain explicit consent from users for utilising their personal information for various analysis, which can be challenging in a rapidly evolving industry.

Balancing Personalisation and Privacy: Personalisation enhances user experiences but requires access to detailed consumer data. Fintech companies must balance data utilisation for personalisation with respecting consumer privacy, ensuring that customer data is protected at all times.

Strategies for Prioritising Data Privacy at CARD91

1. Embedding Privacy into Product Development: CARD91 integrates data privacy considerations from the initial design phase of all products and services, ensuring inherent protection of consumer data.
2. Advanced Security Technologies: CARD91 deploys cutting-edge security technologies, including AI for threat detection and end-to-end encryption, to safeguard consumer data from cyber threats and breaches.
3. Regular Privacy Audits and Assessments: Frequent privacy audits and assessments help CARD91 evaluate and enhance the effectiveness of its data protection measures, identifying and addressing potential vulnerabilities promptly.
4. Employee Training and Awareness Programs: Ongoing training and awareness programs for employees foster a culture of privacy awareness, ensuring all staff members understand their role in protecting consumer data.
5. Consumer Education and Transparency: CARD91 prioritises transparency by clearly communicating its data privacy practices to consumers and providing educational resources to help them understand their rights and protection measures.
6. Robust Incident Response Plan: A comprehensive incident response plan enables swift and effective action in the event of a data breach, minimising its impact on consumers.

By focusing on these key strategies, CARD91 ensures that data privacy remains a top priority while fostering innovation in the Indian fintech market. This approach not only complies with regulatory requirements but also builds lasting trust with customers, driving long-term success.

The Role of Government and Regulatory Bodies

The Indian government and regulatory bodies, such as the Reserve Bank of India (RBI), play a pivotal role in shaping the data privacy landscape. Initiatives like the RBI’s data localisation mandate and the forthcoming Digital Personal Data Protection Bill emphasise the importance of protecting consumer data. The establishment of the Data Protection Authority (DPA) will further strengthen the regulatory framework, ensuring compliance and safeguarding consumer interests.

Conclusion

As India’s fintech sector grows, giving importance to data privacy while fostering innovation is critical. At CARD91, we are dedicated to protecting consumer data through privacy-centric practices and robust security measures, ensuring the safety and trust of our customers.

In an era where data is the new currency, excelling in data privacy is not just a legal obligation but a strategic advantage. Fintech companies that prioritise data privacy will build lasting relationships with their customers, driving long-term success in the dynamic Indian fintech landscape.

At CARD91, we are committed to creating a secure and innovative environment for financial technology in India, ensuring a sustainable and trustworthy future for the industry.

Authored by Astha Bishnoi, Manager – Partnership & Sales at CARD91