Yes, I agree that India sorely needs comprehensive data protection laws. IIRC the IT rules act only concerns with sensitive personal information which includes bank accounts/cards. Though I'm not sure if individual transactions are covered under this.

Given that MasterCard & Visa are only intermediary's between Indian companies and banks, Indian companies(PayTM, PayU, CCAvenue) already have access to all available data as the one who've initiated the transaction. In fact MasterCard/Visa processing the data outside the US actually increases the exposure of data and no amount of US data protection laws will help.