Last updated on August 8th, 2026 at 07:46 pm
TL;DR: Legal compliance for an Indian startup runs from the moment you choose an entity structure through incorporation, IP protection, funding rounds, and ongoing tax, labour, and data-protection obligations. This checklist covers each stage with current requirements: the right entity for your stage, the step-by-step incorporation process, the IP filings that protect your brand and product, what funding rounds actually require, the tax audit and GST thresholds as they stand in 2026, labour law obligations as you hire, and DPDP Act compliance now that its Rules are in force. Use it as a working checklist, not a one-time read.
Quick overview: Compliance is not a single event at incorporation; it is a continuous obligation that changes shape as your startup grows, from a two-founder idea to a funded, employing, revenue-generating company. This guide is organised by the order these obligations actually arise: entity choice, incorporation, immediate post-incorporation steps, IP protection, funding-related compliance, ongoing corporate governance, tax, labour law, and digital and data-protection compliance, closing with sector-specific rules and a practical compliance calendar.
Step 1: Choose the right entity structure
The structure you pick determines your liability exposure, your ability to raise funding, and your ongoing compliance burden. Understanding what makes an agreement legally binding matters less at this stage than understanding which entity actually protects you.
Private Limited Company is the standard choice for startups seeking external funding. It requires a minimum of two directors and two shareholders (who can be the same people), at least one director who is an Indian resident, and a minimum authorised capital of Rs 1 lakh. It carries the most rigorous compliance: mandatory annual audit regardless of turnover, statutory registers, and regular board and shareholder filings, but it is the structure investors expect and the one that supports equity issuance, ESOPs, and future funding rounds.
Limited Liability Partnership (LLP) combines limited liability with lower compliance. It needs a minimum of two partners, at least one an Indian resident, and audit is required only if turnover exceeds Rs 40 lakh or capital contribution exceeds Rs 25 lakh. It suits professional services and businesses that do not plan to raise equity funding, since converting an LLP to a private limited company later is possible but adds cost and process.
One Person Company (OPC) suits a solo founder wanting limited liability without bringing in co-founders. It requires a single director and shareholder, both Indian citizens and residents, a nominee director for continuity, and carries mandatory audit despite the simpler structure.
Sole Proprietorship is the simplest and cheapest to set up but offers no separation between personal and business assets, meaning personal assets are exposed to business debts. It suits very early testing of an idea, not a startup planning to raise funding or hire meaningfully.
Our company registration service in India covers registration across all these structures.
Step 2: Incorporate correctly
For a Private Limited Company, the process runs through five stages. First, every proposed director needs a Director Identification Number (DIN) and a Digital Signature Certificate (DSC), typically issued within three to seven working days of submitting identity and address proof. Second, reserve your company name through the Ministry of Corporate Affairs, checking it is not identical or deceptively similar to an existing name and does not infringe an existing trademark, a reason to run a trademark search and registration early rather than after you have built brand equity around a name you cannot protect. Third, draft the Memorandum of Association (your company’s relationship with the outside world: name, registered office, objects clause, liability, and capital) and the Articles of Association (your internal governance rules on meetings, share transfers, and director appointment). Fourth, file the integrated SPICe+ form, which bundles incorporation, PAN and TAN application, EPFO and ESIC registration, and bank account opening into a single filing. Fifth, on approval, the Registrar of Companies issues a Certificate of Incorporation with your Company Identification Number (CIN).
For an LLP, the path is similar but lighter: obtain a Designated Partner Identification Number (DPIN) for each designated partner, reserve the LLP name, draft the LLP Agreement (capital contribution, profit-sharing, management structure, and dispute resolution), file Form FiLLiP with the required attachments, and receive your LLP Identification Number (LLPIN) on approval.
Step 3: Immediate post-incorporation compliance
Once incorporated, several things need attention right away, not eventually.
PAN and TAN. Usually obtained through SPICe+ during incorporation; if not, file separately, since TAN is mandatory before you can deduct tax at source on any payment.
Banking. Open a corporate bank account with your incorporation certificate, PAN, and a board resolution, complete KYC for all signatories, and set up payment acceptance infrastructure if you will take customer payments.
GST registration. Mandatory once turnover exceeds Rs 20 lakh (Rs 10 lakh for special-category northeastern states), and mandatory regardless of turnover for interstate supply or e-commerce selling. Filed through Form GST REG-01, and once registered, you take on ongoing return filing (monthly or quarterly depending on turnover) and record-keeping obligations that do not go away.
Shops and Establishments registration. A state-specific registration required for essentially every commercial establishment, covering working hours, leave, and basic workplace conditions, and generally needed before you can open a bank account or hire in some states.
Every one of these steps rests on a properly incorporated entity with the right founding documents, which is why our guide on the founders’ agreement for startup co-founders is worth having in place before or alongside incorporation, not after a dispute makes it urgent.
Step 4: Employment documentation, from your first hire
The moment you hire anyone, documentation obligations begin, and getting them right from employee one avoids expensive fixes later.
Every hire needs a proper employment contract covering role, compensation, confidentiality, IP assignment (critical for a startup, since without it the employee, not the company, may own what they build), and termination terms, and where relevant, carefully drafted non-compete and non-solicitation provisions that are enforceable rather than symbolic. Beyond individual contracts, an employee handbook covering policies, code of conduct, leave, and grievance redressal, and basic HR infrastructure, appointment letters, payroll with correct tax deduction, and attendance records, round out the baseline.
Step 5: Protect your intellectual property
For most startups, IP is the core asset, and protecting it early is far cheaper than fixing gaps during due diligence.
Trademark registration protects your name, logo, and distinctive branding: search, file, respond to any examination objections, navigate the four-month opposition window if raised, and receive a registration valid for ten years. Our trademark registration service handles this end to end.
Patent protection, for genuinely novel and non-obvious inventions with industrial application, runs from an optional provisional filing to establish priority, through a complete specification within twelve months, to examination and, if granted, twenty years of protection. Our guide on what a patent is and our patent registration service cover this in depth.
Copyright protects original software code, content, and creative work, arising automatically but strengthened by formal registration, which creates dated, official proof of ownership.
Trade secret protection relies entirely on your own discipline: NDAs with employees, contractors, and partners, access controls on sensitive information, and consistent confidentiality practice, since there is no registry to fall back on if this is neglected.
Step 6: Funding-related compliance
As you raise capital, several obligations activate that did not exist before.
Foreign investment (FEMA). If you accept foreign investment, confirm your sector permits it, understand any sectoral caps, and determine whether you qualify for the automatic route or need government approval. File Form FC-GPR within 30 days of issuing shares to foreign investors, and keep up annual returns on foreign liabilities and assets.
Investment documentation. A term sheet setting out valuation, equity stake, and investor rights, followed by a properly negotiated shareholders’ agreement covering governance, transfer restrictions, and protective provisions, and the underlying share subscription or purchase agreements and board resolutions. Understanding drag-along and tag-along rights and how they affect your exit options matters before you sign, not after.
Cap table discipline. Every funding round changes your capital structure, and keeping a clean cap table with fully diluted ownership tracked correctly, alongside proper filings for each share issuance (Form PAS-3) and any amendment to authorised capital, avoids the reconciliation nightmares that surface during a later round’s due diligence. If you are raising through SAFEs or convertible instruments before a priced round, our guide to SAFE notes and early-stage funding instruments covers the mechanics.
ESOPs. If you offer employee stock options, the scheme needs a shareholder special resolution (not just board approval, a common and costly mistake), proper valuation, and compliant documentation on vesting, exercise, and tax treatment for both company and employees.
Co-founder and equity exits. Startups change shape, and knowing in advance what happens to equity when a co-founder leaves prevents a departure from becoming a legal crisis.
Step 7: Ongoing corporate governance
Compliance does not end at incorporation or your first funding round; it becomes a recurring calendar.
Board governance requires a minimum of one meeting per quarter, proper notice, agendas, and minutes. Shareholder meetings require an Annual General Meeting within six months of financial year-end with 21 days’ notice, presenting financial statements and reappointing directors and auditors as needed, plus Extraordinary General Meetings for urgent matters requiring special resolutions.
Statutory filings include the annual return (Form MGT-7, within 60 days of the AGM), audited financial statements (Form AOC-4, within 30 days of the AGM), and event-based filings whenever a director is appointed or resigns, the registered office changes, or authorised capital changes. Statutory registers, members, directors, loans and investments, and meeting minutes, need to be actively maintained, not assembled retrospectively when a diligence request arrives.
Step 8: Tax compliance, current 2026 thresholds
Tax compliance has two tracks, and both have current figures worth knowing precisely.
Direct tax. A tax audit under what was Section 44AB of the Income Tax Act, 1961 (now renumbered Section 63 under the Income Tax Act, 2025, with the substance unchanged) applies once business turnover exceeds Rs 1 crore, extended to Rs 10 crore where cash receipts and cash payments each stay within 5% of total transactions. Professionals face a flat Rs 50 lakh threshold. Advance tax is paid quarterly, TDS must be deducted, deposited by the 7th of the following month, and reported through quarterly returns, and eligible startups can access the Section 80-IAC tax holiday on profits for three consecutive years within the first ten, subject to DPIIT recognition and the 80-IAC certificate.
Indirect tax. Beyond initial GST registration, ongoing compliance means regular return filing (GSTR-1, GSTR-3B), an annual return (GSTR-9) and, for larger businesses, a reconciliation statement (GSTR-9C), both due by 31 December, plus careful input tax credit management.
Step 9: Labour law compliance as you hire
Several thresholds activate specific obligations as your headcount grows.
Employees’ Provident Fund (EPF) becomes mandatory once you reach 20 or more employees, requiring registration with the regional EPFO office and monthly contributions of 12% each from employer and employee on basic wages. Employees’ State Insurance (ESI) applies to establishments with 10 or more employees earning up to Rs 21,000 per month, with contributions of 3.25% (employer) and 0.75% (employee) and half-yearly returns.
Beyond social security, the Minimum Wages Act and Payment of Wages Act govern timely, correctly calculated pay, the Payment of Gratuity Act applies once you cross 10 employees, requiring gratuity after five years of continuous service, the Maternity Benefit Act mandates 26 weeks of paid leave, and any establishment with 10 or more employees must constitute an Internal Complaints Committee under sexual harassment prevention law, with an annual awareness programme and reporting obligation.
Step 10: Digital, website, and data protection compliance
For any startup with an online presence, and virtually every startup has one, this is where compliance gaps are most common and most consequential.
Mandatory website disclosures. A compliant privacy policy, terms and conditions, clear grievance redressal contact details, and company registration information. Our privacy policy drafting and terms and conditions drafting services cover both, and for platforms with user-generated content or user conduct rules, an acceptable use policy is worth adding.
DPDP Act compliance. This is the area that has changed most since older versions of this checklist. The Digital Personal Data Protection Rules were notified in November 2025, and there is no small-business exemption: any startup collecting personal data, names, emails, phone numbers, customer or employee records, is a Data Fiduciary under the Act, regardless of size, and full compliance is due by 13 May 2027. Our complete DPDP Act compliance guide covers exactly what applies to you and the practical steps to take, and our free DPDP compliance checker gives you a quick read on your current position. Reasonable security safeguards, breach-notification readiness, and genuine consent (not pre-ticked boxes) are not optional extras; the penalties for getting this wrong run into hundreds of crores.
Platforms hosting user content also carry intermediary obligations under the IT Act: due diligence on content, a functioning takedown mechanism, and a designated grievance officer. For SaaS and technology platforms specifically, our technology lawyers and our guides on service level agreements and the master service agreement cover the commercial contracts layered on top of these regulatory obligations.
Sector-specific compliance
Certain sectors carry an additional regulatory layer on top of everything above.
Fintech startups need to navigate RBI’s Payment Aggregator and digital lending guidelines, and where relevant, SEBI or IRDAI requirements. Healthcare startups face CDSCO approvals for medical devices, Telemedicine Practice Guidelines for doctor-patient interactions, and heightened obligations around health data. E-commerce platforms must meet Consumer Protection E-Commerce Rules on disclosures and returns, alongside FDI policy restrictions on inventory-model foreign funding. EdTech startups offering formal qualifications need UGC or AICTE approval and state education department registration. If you operate in a regulated sector, general startup compliance is the floor, not the ceiling.
Build a compliance calendar
The single most effective operational habit is a working compliance calendar, tracking monthly obligations (GST returns, TDS deposits, EPF and ESI contributions), quarterly obligations (TDS returns, board meetings, GST reconciliation), annual obligations (financial statements, tax and secretarial audit, AGM, annual returns), and event-based triggers (director changes, registered office changes, share issuances, foreign investment reporting). Missing a filing date is rarely fatal on its own, but a pattern of missed dates compounds into real regulatory and diligence risk.
Get the right professional support in place
Compliance at this scope is not a solo effort. A relationship with legal counsel covering corporate, IP, and employment matters, a company secretary for governance and statutory filings, and a chartered accountant for tax and audit, forms the baseline team most startups need from an early stage. For your commercial contracts specifically, our contract drafting and contract review and revision services, and our contract lawyers in India, support the legal side of this checklist end to end.
Frequently asked questions
What is the first legal compliance step for a new startup in India?
The first step is choosing the right entity structure, private limited company, LLP, OPC, or sole proprietorship, since this determines your liability exposure, ability to raise funding, and ongoing compliance burden. Most startups planning to raise external funding choose a private limited company despite its heavier compliance, because it is the structure investors expect and the only one that supports straightforward equity issuance and ESOPs.
Is GST registration mandatory for all startups?
GST registration is mandatory once turnover exceeds Rs 20 lakh (Rs 10 lakh for special-category northeastern states), and separately mandatory regardless of turnover for any business making interstate supplies or selling through e-commerce platforms. Below these thresholds and without interstate or e-commerce activity, registration is optional, though many startups register voluntarily to claim input tax credit.
What is the tax audit threshold for startups in 2026?
A tax audit is required once business turnover exceeds Rs 1 crore, extended to Rs 10 crore where both cash receipts and cash payments each stay within 5% of total transactions. Professionals face a separate, flat Rs 50 lakh threshold. This requirement, formerly under Section 44AB of the Income Tax Act, 1961, has been renumbered as Section 63 under the Income Tax Act, 2025, with the substantive thresholds unchanged.
Does the DPDP Act apply to small or early-stage startups?
Yes. There is no small-business exemption under the Digital Personal Data Protection Act. Any startup that collects personal data, customer names, emails, phone numbers, or employee records, is a Data Fiduciary under the Act regardless of size, and full compliance is required by 13 May 2027 following the Rules notified in November 2025. What differs by size is the scale of what needs to be built to comply, not whether the obligation exists.
When does EPF and ESI registration become mandatory?
EPF registration becomes mandatory once a business reaches 20 or more employees, requiring monthly contributions of 12% each from employer and employee on basic wages. ESI applies to establishments with 10 or more employees earning up to Rs 21,000 per month, with contributions of 3.25% from the employer and 0.75% from the employee. Both require registration with the respective regulatory body once the threshold is crossed.
What compliance mistakes do Indian startups most commonly make?
The most common and costly mistakes are approving an ESOP scheme by board resolution instead of the legally required shareholder special resolution, not having IP assignment clauses in employee and contractor contracts (leaving ownership with the individual rather than the company), missing the funding-round filings that create cap table discrepancies later, and treating website legal documents and DPDP compliance as an afterthought rather than a day-one requirement. Most of these surface, expensively, during investor due diligence rather than through direct enforcement.
Authored and reviewed by Prakhar Rai, Advocate, founder of My Legal Pal. Prakhar is enrolled with the Bar Council of India and has over ten years of experience advising startups and founders on incorporation, funding, IP, and regulatory compliance in India. He is an alumnus of the National Law School of India University, Bangalore, where he completed his Master of Business Laws, and of La Martiniere. Connect on LinkedIn.
This article is general information, not legal advice. Compliance thresholds and requirements change and vary by sector, state, and business specifics. For advice on your own startup’s compliance obligations, speak to a qualified lawyer.
If you need help with any stage of this checklist, from incorporation to DPDP compliance, our team can help. Start with company registration, contract drafting, or speak to our contract lawyers in India about a full compliance review.
