Payment gateway tokenisation replaces saved card numbers with network tokens, while encryption protects data during transmission and authorised storage. In India, merchants should assess these controls alongside customer consent, access controls and responsibility for customer data. Razorpay documents card-on-file tokenisation through TokenHQ, PCI DSS Level 1 certification and HTTPS/TLS protection.