PCI DSS, withoutthe compliancetheatre.
SIRI Law LLP helps merchants, payment aggregators and technology platforms scope, assess and maintain PCI DSS compliance, and allocates cardholder data risk correctly in vendor and processor contracts.
- Free first consultation
- RBI payment aggregator guidelines
- Fixed-fee assessments
- Hyderabad and online
- Contract risk allocation
PCI DSS Compliance
Most PCI DSS problems in India are really contract problems. A merchant agreement or payment gateway contract that does not clearly allocate cardholder data liability leaves you exposed however good your technical controls are. We fix both sides.
Merchants accepting card payments
Determining your compliance validation level and the right path to attestation.
Payment aggregators and gateways
Compliance advisory aligned with RBI payment aggregator and payment gateway guidelines.
SaaS platforms storing card data
Advice on tokenisation and scope reduction to lower your compliance burden.
Companies switching processors
Reviewing new processor agreements for cardholder data liability allocation.
Roadmap
Compliance, mapped clearly.
From scoping to attestation, in a sequence that avoids wasted work.
- 01Week one
Determine scope
Your merchant level and cardholder data environment define the requirements that actually apply.
- Merchant level and transaction volume
- Cardholder data environment mapping
- Systems and vendors that touch card data
- Opportunities to reduce scope
- 02Weeks two to four
Assess the gap
A structured review against the applicable PCI DSS requirements.
- Requirement-by-requirement gap assessment
- Network segmentation review
- Vendor and third-party assessment
- Remediation plan with priorities
- 03Ongoing
Remediate and document
Controls, policies and evidence come together.
- Technical control remediation, coordinated with your IT team
- Policy and procedure documentation
- Evidence collection for the assessment
- Self-Assessment Questionnaire or QSA report, as applicable
- 04Annual
Attest and maintain
Compliance is validated and then maintained.
- Attestation of Compliance
- Quarterly vulnerability scans where required
- Annual reassessment planning
- Ongoing contract review as vendors change
What we do
PCI DSS, handled properly.
Technical scoping paired with the contract work that actually protects you.
Scope and level determination
Establishing your merchant level and cardholder data environment boundaries.
- Scoping
- Merchant level
- CDE
Gap assessment
A requirement-by-requirement review against applicable PCI DSS controls.
- Gap assessment
- Requirements
- Remediation
Scope reduction advisory
Tokenisation, outsourcing and segmentation strategies to shrink your compliance burden.
- Tokenisation
- Segmentation
- Scope reduction
QSA and acquirer liaison
Coordinating with your assessor and acquiring bank through the validation process.
- QSA
- Acquirer
- Liaison
Processor and gateway contract review
Making sure liability for cardholder data incidents is allocated correctly.
- Contracts
- Liability
- Processors
RBI payment aggregator compliance
Advisory aligned with RBI's payment aggregator and payment gateway guidelines.
- RBI
- Payment aggregators
- Regulatory
Incident response planning
A cardholder data breach response plan that meets card network and contractual obligations.
- Incident response
- Breach
- Card networks
Vendor risk assessment
Assessing service providers that store, process or transmit cardholder data on your behalf.
- Vendors
- Service providers
- Risk
Where we come in
Five mistakes we often see.
Each one turns a manageable compliance task into a costly one.
Treating PCI DSS as purely a technical exercise
Contracts with processors and vendors determine who bears liability when something goes wrong. Technical controls alone do not settle that.
Not reducing scope where possible
Tokenisation and outsourcing card storage to a compliant processor can dramatically shrink what you need to secure and assess.
Missing the RBI angle
Payment aggregators and gateways in India face RBI guidelines layered on top of PCI DSS. Treating them as the same thing creates gaps.
Self-assessing when a QSA is required
Merchant level determines whether self-assessment is permitted. Getting this wrong can invalidate your compliance status.
Letting vendor contracts lapse on renewal
A processor contract renewed without review can quietly drop liability protections that were negotiated the first time.
Ready to start?
Need to prove PCI DSS compliance to a processor or partner? Call for a free first consultation.
Tell us your merchant level and current setup and we will map what applies to you. Calls are answered by an advocate.
Why companies choose us
Technical scope, legal protection.
Retain us for a single matter or for the long run. Either way you deal with the same accountable team.
Contracts that match your controls
We make sure your processor and vendor agreements reflect what your technical environment actually does.
RBI-aware advisory
Payment aggregator and gateway guidelines are built into our review, not treated as a separate exercise.
Scope reduction focus
We look for ways to shrink your compliance burden before assessing it in full.
Google reviews
See what our clients say on Google.
We would rather you read independent reviews than take our word for it. Every review is on our Google Business Profile.
Questions
Common questions.
General information only, not legal advice. Every situation differs, so speak to us about yours.
What merchant level applies to us?
Merchant level is set by card network transaction volume thresholds and determines whether self-assessment or a QSA-led assessment is required.
We help you confirm your level with your acquiring bank.
Do we need a QSA?
Higher-volume merchants and most payment aggregators require a Qualified Security Assessor. Lower-volume merchants may self-assess using a Self-Assessment Questionnaire.
We advise on which path applies and support either route.
Can we reduce our PCI DSS scope?
Often yes. Tokenising card data, outsourcing storage to a compliant processor, and segmenting your network can significantly reduce what falls in scope.
We assess scope reduction options early, since they change the entire assessment.
How does RBI regulation interact with PCI DSS?
Payment aggregators and payment gateways in India must also meet RBI's specific guidelines, which cover areas PCI DSS does not, such as nodal account structures.
We advise on both together so nothing is missed.
What happens if we have a card data breach?
Card network rules, RBI requirements and your contracts with processors and customers all impose separate notification and liability obligations.
We help you respond in a way that satisfies all of them.
How much does this cost?
Assessment work is available as a fixed fee once scope is confirmed, separate from any fees charged by your QSA.
Fees are agreed in writing before work starts.
Related
Often needed alongside.
PCI DSS compliance often involves these services too.
Cybersecurity & Compliance
Testing, ISO 27001 and SOC 2.
ExploreSOC 2 Readiness
Type I and Type II readiness.
Explore
Banking & Finance
Fintech and payments regulatory advisory.
Explore
Data Privacy & Cyber Law
DPDP Act, GDPR and breach response.
Explore
Free first consultation
Tell us about your pci matter.
High level is fine. We check conflicts, tell you honestly whether we can help, and what it would cost. You decide, with no pressure.
- Call+91 79819 12046
- WhatsAppMessage us on WhatsApp
- Emailinfo@sirilawllp.com
- HoursMon–Sat, 9:30 AM–7:00 PM IST. Incident line 24/7.
- Existing client?Message your named lead directly, or use the incident line for anything urgent.
Thank you. We have your enquiry.
A member of our team will be in touch within one working day. For anything urgent, call +91 79819 12046.
Visit us
Find our offices.
HITEC City, Madhapur, Hyderabad, Telangana 500081
Mon to Sat, 9:30 AM to 7:00 PM IST · Meetings by appointment · Online consultations worldwide