Payment gateways and personal data: how the DPDP Act applies
Reviewed by Confidential Dispatch Editorial Team · Updated 31 Oct 2026 · 11 min read
A payment gateway handles your customers’ names, phone numbers, card and UPI details and every transaction record. Under India’s DPDP Act, your business is the Data Fiduciary for the customer data you collect and use. The gateway is more than your processor: it also holds payment data for its own legal duties. RBI requires payment data to be stored only in India, whichever gateway you use. Your part is the notice at checkout, using payment data only for payments, and never storing card numbers.
Educational resource only. These are our findings from each company’s public documentation as of the “Last updated” date at the end of this page. Vendors change their products and terms, so check the current version before you rely on it. We don’t assess or certify any company’s compliance. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to your use of these tools; it is not formal legal advice.
The situation
A customer pays for an order on your website, scans a UPI QR code at your counter, or clicks a payment link you sent on WhatsApp. Behind each of these, a payment gateway such as Razorpay, PayU or Cashfree collects the customer’s details, takes the payment and sends you a record of it. Payments are among the most regulated activities in India already, so it’s easy to assume the gateway takes care of the data side too. With the DPDP Act’s full obligations applying from 13 May 2027, it helps to know which part the gateway answers for and which part stays with you.
Is any payment gateway “DPDP-compliant”?
No gateway makes your business compliant, and a gateway isn’t only your processor: it also holds payment data in its own right
You decide why you collect your customers’ details and how you use them afterwards, which makes you the Data Fiduciary for that data. When the gateway processes a payment for you and passes the record back, it is acting as your Data Processor, and the Act requires you to have a valid contract with any processor you use (Section 8).
Payment gateways also have legal duties of their own, as payment aggregators regulated by the Reserve Bank of India (RBI). Razorpay’s notice to buyers names Razorpay itself as the Data Fiduciary and lists KYC and anti-money laundering compliance among its purposes, and Cashfree’s policy cites the Prevention of Money-Laundering Act among the laws it works under. So the gateway answers for what it keeps under its own obligations, and you answer for what you collect, store and do with your customers’ data. The gateway differences below are about how much help each gives you and what each says about where it stores data.
What personal data flows through a payment gateway?
Every payment carries a bundle of personal data, and copies of much of it end up in your own systems too
Whichever gateway you use, the flow typically includes:
- Checkout details: the customer’s name, email address and phone number, entered on your checkout or the gateway’s payment page.
- Payment credentials: card numbers, UPI IDs and bank account details. These are entered on the gateway’s secure page, and saved cards are replaced with tokens, so you never see the full card number.
- Transaction records: amount, date, what was bought, the payment method and technical details such as the customer’s IP address and device.
- Payment links and pages: any extra fields you add to a payment link or a hosted payment page, such as an address, a date of birth or a membership number.
- Refunds and disputes: refund records and the evidence you send for a chargeback, which can include delivery addresses, invoices and your conversations with the customer.
- Payouts: if you use the gateway to pay vendors, staff or customers, their names and bank account or UPI details.
- Exports and webhooks: the reports you download and the data the gateway sends to your website, accounting software or CRM, which then sits in those systems as well.
What DPDP duties does your payment gateway create?
Most of your duties sit at the edges: what you ask for at checkout, and what you do with the data afterwards
- Notice at checkout. Your checkout page or payment link is a point of collection. It needs a clear notice of what you collect and why (Section 5).
- Purpose limits. A phone number given to complete a payment was given for that payment. Using it for WhatsApp offers or a marketing list needs its own consent (Section 6), asked for separately and unticked by default.
- Only what the payment needs. Every extra field on a payment link or payment page is data you have to protect and delete later. Ask only for what the payment, delivery or invoice needs.
- Never store card numbers. RBI’s card tokenisation rules prohibit merchants from storing card numbers on their own systems. Saved-card features have to run through the gateway’s tokenisation, and card numbers should never sit in your spreadsheets, emails or support tickets.
- Deletion on time. Tax and accounting laws require you to keep invoice and transaction records for set periods. Keep what those laws require, and delete the rest, including old exports and copies in other tools, once the purpose is over (Section 8).
- Security. Who can see customer details on the gateway dashboard, who can download reports, and who holds your API (application programming interface) keys are all part of your duty to protect the data.
- Rights requests. A customer can ask what you hold about them, ask you to correct it, or ask you to delete it. You answer for the data in your systems. The gateway answers for what it keeps under its own legal duties, and can refuse to delete what the law requires it to keep.
- Breaches. If customer payment data leaks from your side, through a downloaded report, a compromised dashboard login or an exposed API key, you must inform the Data Protection Board of India and the affected people.
Where does each gateway store your data?
By RBI mandate, every authorised payment gateway, including all three below, has to store payment data only in India
The DPDP Act allows personal data to go abroad except to countries the government restricts (Section 16), but it leaves stricter sector rules in place. RBI’s rule on storing payment system data applies to every payment system provider it authorises: the entire payment data, including customer data, payment credentials and transaction data, has to be stored in systems located only in India. If a payment is processed abroad, the data must be deleted there and brought back to India within one business day or 24 hours, whichever is earlier. RBI’s list of authorised payment system operators includes Razorpay, PayU and Cashfree as payment aggregators, so the rule applies to each of them.
| Gateway | Authorised by RBI as a payment aggregator? | Where customers send privacy requests |
|---|---|---|
| Razorpay | Yes | Razorpay’s support page |
| PayU | Yes | PayU’s consent page or privacy email |
| Cashfree Payments | Yes | Cashfree’s privacy email, in writing |
Razorpay
Razorpay presents itself as a Data Fiduciary for buyers’ data, and says it holds RBI authorisation as a payment aggregator
Its buyer privacy notice names Razorpay Payments Private Limited as the Data Fiduciary for the personal data it collects, including identifiers, transaction data and device data, and lists complying with legal and regulatory obligations such as KYC and anti-money laundering rules among its purposes. Its main privacy policy refers to the DPDP Act for the rights to access data and withdraw consent, and says Razorpay won’t transfer personal data to any country the government prohibits.
For your side of the duties, Razorpay’s tokenisation provides saved cards without any raw card data reaching your servers. The dashboard has fixed team roles, from Owner and Admin to view-only Auditor and Support, and view-only users can’t download or export files. The account owner can turn on two-step verification for the whole team from Manage Team. Payment Pages let you add your own input fields beyond name, email and phone, so keep those to what the payment needs.
PayU
PayU states that all payments-related data is stored in India
Its privacy statement, updated 28 January 2026, says payments-related data will be stored in India in accordance with Indian law, and that PayU keeps data for as long as it is required and permitted under Indian law, without listing specific periods. It describes PayU as processing personal information received from merchants in its role as a payment aggregator, and says that in some situations merchants, payment partners and financial institutions are responsible for the customer’s personal information.
PayU offers stored-card and tokenisation features in line with Indian law, and states that it follows payment card industry standards and is audited for its security certification. In the PayU Dashboard, the User and Permissions tile on the Settings page lets you manage users and roles, with permissions set for each Dashboard module, and turn on two-step verification. Customers can exercise their rights through PayU’s consent page or by writing to its privacy email address.
Cashfree Payments
Cashfree’s privacy policy names the payments and anti-money laundering laws it works under
It describes Cashfree as operating as a payment aggregator and lists the Payment and Settlement Systems Act, 2007, the Prevention of Money-Laundering Act, 2002 and the Information Technology Act, 2000 among the laws that apply to it. It says data is kept no longer than its purpose or the law requires. Customers can review their data, ask for corrections and withdraw consent in writing, with those rights limited where Cashfree is legally required to keep the data.
For your side, Cashfree replaces card data with a random token stored in a vault that meets the card industry’s security standard (PCI DSS), and holds that standard at Level 1, its highest grade. Its access management lets you invite users, create custom roles and set view or manage permissions for each feature, and Cashfree recommends turning on two-factor authentication for everyone who uses the dashboard. Download rights follow those permissions, so limit report access to the people who need it.
How to set up any payment gateway for the DPDP Act
The steps are the same whichever gateway you use; only the setting names change
- Check that your gateway is authorised by RBIRBI publishes a list of authorised payment system operators, and its rule that payment data stays in India applies to every payment aggregator on it.
- Add a notice to your checkoutSay what you collect, why, and who processes the payment, on your checkout page and on payment links and pages.
- Separate payment from marketingIf you want to use checkout details for offers or updates, ask for that consent separately, with an unticked box.
- Cut extra fieldsRemove any field on a payment link or page that the payment, delivery or invoice doesn’t need.
- Lock down the dashboardTurn on two-step verification for every user, give each person the narrowest role that fits their work, limit who can download reports, and remove people who leave.
- Keep card numbers out of your systemsUse the gateway’s tokenisation for saved cards, and check that no card numbers sit in spreadsheets, emails or support tickets.
- Set a retention rule for exportsDecide how long downloaded reports and synced copies in other tools stay, and delete them on schedule. As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your payment gateway’s privacy settings, release notes and announcements to see what has changed.
- Know where each request goesAnswer requests about data in your systems yourself, and know how to point customers to the gateway for what it keeps under its own duties.
FAQ
Is Razorpay, PayU or Cashfree DPDP-compliant?
None of them can make your business compliant. The DPDP Act’s duties for the customer data you collect and use fall on your business as the Data Fiduciary. Each gateway also has its own duties for the payment data it keeps under RBI rules and other laws.
Is the payment gateway my Data Processor?
For the payments it processes for you, yes, and you need a valid contract with it. For the data it keeps for its own legal duties, such as KYC and anti-money laundering checks, it acts on its own account. Razorpay’s notice to buyers, for example, names Razorpay as the Data Fiduciary.
Does payment data have to stay in India?
Yes. RBI requires the payment system providers it authorises to store payment data only in India. The DPDP Act’s general permission to transfer data abroad doesn’t override that rule.
Can I store my customers’ card numbers?
No. RBI’s tokenisation rules prohibit merchants from storing card numbers. Use your gateway’s saved-card or tokenisation feature, which replaces the card number with a token.
Can a customer ask the gateway to delete their payment data?
They can ask, but the gateway can keep what RBI, anti-money laundering or tax laws require it to hold. Razorpay’s and Cashfree’s privacy notices both make deletion or other rights subject to what the law requires them to keep.
Will my payment gateway add DPDP features?
As the DPDP Act’s 13 May 2027 deadline approaches, you can expect most large Indian platforms, and those that operate in India, to launch features in line with the Act. Keep an eye on your payment gateway’s privacy settings, release notes and announcements to see what has changed.
Every article is checked against the current law and the judgments it cites before it is published.
Updated 31 October 2026 · Not legal advice.
