Startup Legal Compliance India 2026 - Complete Checklist & Guide

# Legal Compliance for Startups in India: Complete Checklist (2026)

India's startup ecosystem has grown rapidly over the past decade, supported by government initiatives such as the Startup India programme and a progressively digitized regulatory framework. However, the legal and regulatory landscape for startups remains complex, spanning company law, taxation, labour regulations, data protection, intellectual property, and sector-specific compliances. Founders who overlook these obligations early on often face penalties, investor pushback during due diligence, or operational disruptions at critical growth stages.

This article provides a comprehensive compliance checklist for Indian startups — from choosing the right business structure to ongoing annual filings — so that founders can build on a sound legal foundation.

> **Disclaimer:** This article is for general informational and educational purposes only. It does not constitute legal advice. Laws, rules, and government portal procedures are subject to change. Readers are encouraged to consult a qualified professional before acting on any information contained herein.

---

Choosing the Right Business Structure

The first legal decision a founder makes is selecting a business structure. The three most common options for startups in India are a **Private Limited Company**, a **Limited Liability Partnership (LLP)**, and a **One Person Company (OPC)**. Each has distinct legal, tax, and operational implications.

Private Limited Company

Governed by the **Companies Act, 2013**, a private limited company is the most widely preferred structure for startups, particularly those seeking external investment.

- **Separate legal entity** with perpetual succession.

- **Limited liability** for shareholders (Section 2(68), Companies Act, 2013).

- Minimum **2 directors** and **2 shareholders** (Section 149(1)).

- At least **one director must be an Indian resident** — a person who has stayed in India for at least 120 days in the previous financial year (Section 149(3)).

- Can issue **Employee Stock Option Plans (ESOPs)** under Section 62(1)(b).

- Preferred by venture capital and angel investors for equity investment.

Limited Liability Partnership (LLP)

Governed by the **Limited Liability Partnership Act, 2008**, an LLP combines the limited liability of a company with the operational flexibility of a partnership.

- Minimum **2 designated partners** (Section 7), at least one of whom must be an Indian resident.

- No minimum capital requirement.

- Lower compliance burden than a private limited company (no mandatory audit unless turnover exceeds Rs. 40 lakhs or capital contribution exceeds Rs. 25 lakhs).

- However, LLPs **cannot issue equity shares** to investors, making fundraising through equity dilution structurally more complex.

- Conversion from LLP to a company is possible under **Section 366** of the Companies Act, 2013.

One Person Company (OPC)

Introduced under **Section 3(1)(c)** of the Companies Act, 2013, an OPC allows a single person to incorporate a company with limited liability. It is suitable for solo entrepreneurs who want the corporate structure without requiring a second shareholder.

- Only **1 director and 1 shareholder** required.

- A **nominee** must be designated at the time of incorporation (Section 3(1)(c) proviso).

- Must convert to a private limited company if paid-up capital exceeds Rs. 50 lakhs or turnover exceeds Rs. 2 crores (Section 18, Companies (Incorporation) Rules, 2014, as amended).

Comparison Table

| Feature | Private Limited Company | LLP | OPC |

|---|---|---|---|

| Limited liability | Yes | Yes | Yes |

| ESOP issuance | Yes | No | No |

---

Company Registration: The SPICe+ Process

For startups incorporating as a private limited company, the **Ministry of Corporate Affairs (MCA)** has consolidated the incorporation process through the **SPICe+ (Simplified Proforma for Incorporating a Company Electronically Plus)** form, introduced vide notification dated February 23, 2020.

SPICe+ is an integrated form that provides the following in a single application:

1. **Company incorporation** and Certificate of Incorporation (CIN).

2. **Director Identification Number (DIN)** allotment for up to 3 directors.

3. **PAN and TAN** of the company (automatic linkage with CBDT).

4. **EPFO registration** (Employees' Provident Fund).

5. **ESIC registration** (Employees' State Insurance).

6. **Profession Tax registration** (in applicable states such as Maharashtra).

7. **Bank account opening** (through AGILE-PRO-S form filed alongside SPICe+).

8. **GSTIN allotment** (if GST registration is applied for).

Key attachments include the **e-MOA (INC-33)**, **e-AOA (INC-34)**, and **AGILE-PRO-S (INC-35)**. Each proposed director must obtain a **Class 3 Digital Signature Certificate (DSC)** from a licensed Certifying Authority under the Information Technology Act, 2000.

After incorporation, the company must file **Form INC-20A** (declaration for commencement of business) within **180 days**, confirming that subscribers have paid the value of shares agreed to be taken (Section 10A, Companies Act, 2013).

---

Startup India Recognition (DPIIT)

The **Startup India initiative**, administered by the **Department for Promotion of Industry and Internal Trade (DPIIT)**, provides recognition and benefits to eligible startups.

Eligibility Criteria

An entity qualifies as a "startup" under the DPIIT framework if:

- It is incorporated as a **Private Limited Company, LLP, or Partnership Firm** in India.

- It has been incorporated for **not more than 10 years** from the date of incorporation.

- Its turnover has **not exceeded Rs. 100 crores** in any financial year since incorporation.

- It is working towards **innovation, development, or improvement** of products, processes, or services, or has a **scalable business model** with high potential for employment generation or wealth creation.

- It has **not been formed by splitting up or reconstruction** of an existing business.

How to Apply

1. Register on the **Startup India portal** ([startupindia.gov.in](https://www.startupindia.gov.in)).

2. Fill in the recognition application with entity details, business description, and innovation narrative.

3. Upload the **Certificate of Incorporation/Registration** and a brief description of the startup's innovative nature.

4. DPIIT issues a **recognition certificate** upon approval.

Recognition is a prerequisite for availing key benefits discussed later in this article, including the Section 80-IAC tax holiday and angel tax exemption.

---

Tax Compliance

Tax compliance is a foundational obligation for every startup, regardless of revenue stage.

PAN and TAN

- **Permanent Account Number (PAN):** Allotted automatically during incorporation through SPICe+. Required for all financial transactions, tax filings, and bank account operations.

- **Tax Deduction and Collection Account Number (TAN):** Also allotted through SPICe+. Required for deducting and remitting TDS (Tax Deducted at Source) on salary payments, contractor payments, rent, professional fees, and other specified payments under the **Income Tax Act, 1961**.

GST Registration

Under the **Central Goods and Services Tax Act, 2017**, GST registration is mandatory if:

- Aggregate turnover exceeds **Rs. 20 lakhs** (Rs. 10 lakhs for special category states) for service providers.

- Aggregate turnover exceeds **Rs. 40 lakhs** (Rs. 20 lakhs for special category states) for goods suppliers.

- The startup makes **inter-state supplies** (mandatory registration regardless of turnover).

- The startup sells through **e-commerce platforms** (mandatory registration under Section 24).

Even below these thresholds, **voluntary registration** is advisable for startups that deal with registered businesses, as it enables input tax credit claims.

TDS Compliance

A startup must deduct TDS on specified payments under **Chapter XVII-B of the Income Tax Act, 1961**, including:

- **Salary** (Section 192)

- **Payments to contractors/sub-contractors** (Section 194C)

- **Rent** (Section 194-I)

- **Professional or technical services** (Section 194J)

- **Commission or brokerage** (Section 194H)

TDS returns must be filed **quarterly** (Form 24Q for salary, Form 26Q for non-salary deductions), and TDS certificates (Form 16/16A) must be issued to deductees.

Advance Tax

If the estimated tax liability for a financial year exceeds **Rs. 10,000**, advance tax must be paid in quarterly installments under **Section 208 of the Income Tax Act, 1961** (due dates: June 15, September 15, December 15, and March 15).

---

Labour Law Compliance

Labour law compliance becomes critical as a startup begins hiring. Key obligations include:

Employees' Provident Fund (EPF)

Under the **Employees' Provident Funds and Miscellaneous Provisions Act, 1952**, EPF registration is mandatory for establishments employing **20 or more employees**. Both employer and employee contribute **12% of basic wages** to the EPF account. Non-compliance attracts penalties under **Section 14B** (damages) and **Section 406 of the Indian Penal Code** (criminal liability for misappropriation).

Employees' State Insurance (ESI)

Under the **Employees' State Insurance Act, 1948**, ESI registration is mandatory for establishments employing **10 or more employees** (in notified areas) where employee wages do not exceed **Rs. 21,000 per month**. ESI provides medical, sickness, maternity, and disability benefits.

Shops and Establishments Act

Every startup operating from a commercial premises must register under the applicable state's **Shops and Establishments Act** (e.g., the **Maharashtra Shops and Establishments (Regulation of Employment and Conditions of Service) Act, 2017** in Maharashtra). This registration governs working hours, leave entitlements, holidays, and conditions of employment.

POSH Act — Prevention of Sexual Harassment

The **Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (POSH Act)** applies to **every workplace** with employees. Key compliance requirements:

- Every employer with **10 or more employees** must constitute an **Internal Complaints Committee (ICC)** (Section 4).

- The ICC must be chaired by a **senior woman employee** and must include an **external member** from an NGO or a person familiar with issues relating to sexual harassment.

- The employer must conduct **awareness workshops** and display information about the POSH policy at conspicuous places in the workplace.

- An **annual report** must be filed with the District Officer (Section 21).

The Supreme Court in *Vishaka v. State of Rajasthan, AIR 1997 SC 3011* laid the foundational guidelines for prevention of sexual harassment at the workplace, which were subsequently codified by the POSH Act, 2013.

Professional Tax

Applicable in states such as Maharashtra, Karnataka, and West Bengal. The maximum professional tax is **Rs. 2,500 per annum** per employee (varies by state). Employers are required to register, deduct, and remit professional tax.

---

Intellectual Property Protection

Startups thrive on innovation, making intellectual property (IP) protection a strategic necessity.

Trademark Registration

A trademark protects the startup's **brand name, logo, tagline, or any distinctive mark** used in trade. Registration under the **Trade Marks Act, 1999** provides:

- **Exclusive right** to use the mark in connection with the registered goods or services (Section 28).

- **Legal presumption of validity**, which strengthens enforcement actions.

- Protection against infringement and passing off.

- Registration is valid for **10 years** and renewable indefinitely.

Apply through the **IP India portal** ([ipindia.gov.in](https://ipindia.gov.in)). DPIIT-recognized startups benefit from **expedited examination** of trademark applications.

Copyright

Copyright protects original **literary, artistic, musical, and dramatic works**, as well as **software code**, under the **Copyright Act, 1957**. Copyright subsists automatically upon creation; however, **registration** provides evidentiary advantages and is recommended. Software source code can be registered as a literary work.

Patent

For startups with novel technical inventions, patent protection under the **Patents Act, 1970** provides a **20-year monopoly** over the patented invention (Section 53). DPIIT-recognized startups benefit from:

- **Expedited examination** of patent applications (fast-tracked to 6-12 months instead of the usual 3-5 years).

- Up to **80% rebate on patent filing fees** (for startups and small entities).

---

Digital Personal Data Protection Act, 2023

The **Digital Personal Data Protection Act, 2023 (DPDPA)** is India's comprehensive data protection legislation. Startups that collect, store, or process **digital personal data** of individuals (termed "data principals") are classified as **"data fiduciaries"** and must comply with the following:

- **Lawful purpose and consent:** Personal data must be processed only for a lawful purpose with the **free, specific, informed, and unambiguous consent** of the data principal (Section 4 and Section 6).

- **Notice requirement:** Before collecting data, provide a clear notice in plain language specifying the personal data being collected, the purpose of processing, and the manner in which the data principal can exercise their rights (Section 5).

- **Purpose limitation:** Data must be processed only for the purpose for which consent was obtained.

- **Data security:** Implement **reasonable security safeguards** to protect personal data from breaches (Section 8).

- **Breach notification:** In the event of a personal data breach, notify the **Data Protection Board of India** and affected data principals (Section 8(6)).

- **Rights of data principals:** Facilitate rights including the right to access information, right to correction and erasure, right to grievance redressal, and right to nominate (Sections 11-14).

- **Data of children:** Processing personal data of children (below 18 years) requires **verifiable consent of the parent or lawful guardian**, and targeted advertising directed at children is prohibited (Section 9).

- **Cross-border transfer:** Personal data may be transferred outside India except to countries notified and restricted by the Central Government (Section 16).

Non-compliance with the DPDPA can attract **penalties up to Rs. 250 crores** per instance, depending on the nature of the violation (Schedule to the Act).

Startups should conduct a **data mapping exercise** early on to understand what personal data they collect, where it is stored, who has access, and how it is protected.

---

Essential Contracts and Agreements

Legally sound contracts form the backbone of a startup's operations. Key agreements include:

Co-Founder Agreement

A co-founder agreement should address:

- **Roles, responsibilities, and designations** of each co-founder.

- **Equity split** and vesting schedule (typically 4-year vesting with a 1-year cliff).

- **Intellectual property assignment** — all IP created by co-founders should vest in the company.

- **Non-compete and non-solicitation** obligations.

- **Exit provisions** — what happens if a co-founder leaves (bad leaver vs. good leaver clauses).

- **Decision-making and dispute resolution** mechanisms.

The Supreme Court in *Indian Oil Corporation Ltd. v. Amritsar Gas Service, (1991) 1 SCC 533* reiterated that contracts must be interpreted based on the express terms agreed between the parties, underscoring the importance of clear drafting.

Employment Contracts

Every employee should have a written employment contract covering:

- Designation, reporting structure, and job description.

- Compensation, benefits, and leave entitlements.

- **Confidentiality and non-disclosure** obligations.

- **IP assignment** clauses (ensuring work created during employment vests in the company).

- **Non-compete** clauses (note: post-employment non-competes are generally **unenforceable** in India as being in restraint of trade under **Section 27 of the Indian Contract Act, 1872**, as held in *Pepsi Foods Ltd. v. Bharat Coca-Cola Holdings Pvt. Ltd., 1999 SCC OnLine Del 870*; however, restrictions during employment are valid).

- Termination provisions and notice period.

Non-Disclosure Agreements (NDAs)

NDAs protect confidential business information shared with potential investors, partners, contractors, or employees. A well-drafted NDA should define the confidential information with specificity, state the purpose of disclosure, specify the duration of the obligation, and outline remedies for breach.

Vendor and Service Agreements

Contracts with vendors, service providers, and freelancers should clearly address the scope of work, payment terms, deliverables, timelines, IP ownership, liability limitations, indemnification, and termination provisions.

---

FEMA Compliance for Foreign Investment

Startups receiving **foreign investment** must comply with the **Foreign Exchange Management Act, 1999 (FEMA)** and the **Foreign Exchange Management (Non-debt Instruments) Rules, 2019**.

Key considerations:

- **Automatic route vs. approval route:** Most sectors permit foreign direct investment (FDI) under the **automatic route** (no prior government approval needed). Certain sectors (defence, media, multi-brand retail) require **government approval**.

- **Pricing guidelines:** Shares issued to foreign investors must comply with **minimum pricing norms** — typically at or above the fair market value as determined by a SEBI-registered merchant banker or a Chartered Accountant using a prescribed valuation method.

- **Reporting requirements:** File **Form FC-GPR** (for issuance of shares), **Form FC-TRS** (for transfer of shares), and other prescribed forms with the **Reserve Bank of India (RBI)** within specified timelines through the **FIRMS portal**.

- **Sectoral caps:** Ensure the foreign investment does not exceed the **sectoral cap** applicable to your industry (e.g., 100% under automatic route for most IT and startup sectors).

- **Downstream investment:** If an Indian company with foreign investment further invests in another Indian company, **downstream investment rules** under the FEMA NDI Rules apply.

Non-compliance with FEMA provisions can attract a **penalty up to three times the sum involved**, or Rs. 2 lakhs where the amount is not quantifiable (Section 13, FEMA, 1999).

---

Annual Compliance Calendar

Once operational, a startup must adhere to recurring compliance deadlines. Below is a summary for a private limited company:

Board Meetings

- Minimum **4 board meetings per year**, with no gap of more than **120 days** between two consecutive meetings (Section 173, Companies Act, 2013).

- The **first board meeting** must be held within **30 days** of incorporation.

Annual General Meeting (AGM)

- The first AGM must be held within **9 months** from the close of the first financial year (Section 96).

- Subsequent AGMs must be held within **6 months** from the close of the financial year, with no more than **15 months** between two consecutive AGMs.

Statutory Auditor

- Appoint a statutory auditor within **30 days** of incorporation (Section 139).

Annual Return and Financial Statements

- **Form AOC-4:** File financial statements within **30 days** of the AGM.

- **Form MGT-7/MGT-7A:** File the annual return within **60 days** of the AGM.

Income Tax Return

- Due by **October 31** (for companies requiring audit; or November 30 if transfer pricing provisions apply).

GST Returns

- **GSTR-1:** Monthly or quarterly (for those under the QRMP scheme), by the 11th or 13th of the following month.

- **GSTR-3B:** Monthly or quarterly, by the 20th of the following month.

- **GSTR-9:** Annual return, by December 31.

TDS Returns

- Quarterly: **Form 24Q** (salary) and **Form 26Q** (non-salary), due within one month from the end of each quarter.

EPF and ESI

- Monthly contributions must be remitted by the **15th of the following month**.

POSH Act

- **Annual report** to be filed with the District Officer (Section 21, POSH Act, 2013).

---

Startup India Benefits

DPIIT-recognized startups enjoy several significant legal and fiscal benefits:

Tax Holiday under Section 80-IAC

Eligible startups can claim a **100% deduction of profits** for **3 consecutive assessment years** out of the first 10 years from the date of incorporation (Section 80-IAC, Income Tax Act, 1961). Conditions include:

- The startup must be incorporated between April 1, 2016, and March 31, 2027.

- It must be a company or LLP (not a partnership firm or proprietorship).

- Total turnover must not exceed **Rs. 100 crores** in the relevant financial year.

- The startup must be certified by the **Inter-Ministerial Board of Certification** set up under DPIIT.

Angel Tax Exemption

**Section 56(2)(viib)** of the Income Tax Act (the so-called "angel tax") treats share premium received by a closely held company in excess of fair market value as income. DPIIT-recognized startups are **exempt** from this provision, subject to:

- The aggregate amount of paid-up share capital and share premium after the proposed issue not exceeding **Rs. 25 crores**.

- Filing **Form 2** (DPIIT declaration) with the CBDT.

Note: The Union Budget 2024-25 proposed the removal of Section 56(2)(viib) for all companies (not just startups) for shares issued to residents. Startups should verify the current status of this provision.

Self-Certification for Labour and Environmental Laws

DPIIT-recognized startups are permitted to **self-certify compliance** with 6 labour laws and 3 environmental laws for a period of **3 years** from the date of incorporation, reducing the regulatory inspection burden. The 6 labour laws include:

1. The Industrial Disputes Act, 1947

2. The Trade Unions Act, 1926

3. The Building and Other Construction Workers (Regulation of Employment and Conditions of Service) Act, 1996

4. The Industrial Employment (Standing Orders) Act, 1946

5. The Inter-State Migrant Workmen (Regulation of Employment and Conditions of Service) Act, 1979

6. The Payment of Gratuity Act, 1972

Other Benefits

- **Fast-tracked patent examination** with up to 80% fee rebate.

- **Relaxed public procurement norms** — startups are exempt from prior experience and turnover requirements in government tenders.

- **Access to Fund of Funds** managed by SIDBI.

- **Credit Guarantee Scheme** providing collateral-free loans.

---

Common Mistakes Startups Make

Based on common issues observed during legal due diligence and compliance audits:

1. **Not formalizing the co-founder relationship.** Operating without a co-founder agreement leads to disputes over equity, roles, and IP ownership. Many promising startups have collapsed due to co-founder conflicts that lacked a contractual framework for resolution.

2. **Ignoring IP assignment.** If founders or employees develop IP without a formal assignment clause, the ownership may remain with the individual, not the company. This is a critical due diligence red flag for investors.

3. **Delayed GST registration.** Operating beyond the threshold without GST registration attracts penalties and interest under **Sections 122-125 of the CGST Act, 2017**.

4. **Non-compliance with TDS obligations.** Failure to deduct or deposit TDS attracts interest under **Section 201(1A)** and penalties under **Section 271C** of the Income Tax Act, 1961.

5. **Ignoring the POSH Act.** Many startups assume the POSH Act applies only to large organizations. The requirement to constitute an ICC applies to every employer with **10 or more employees**, and failure to comply is a punishable offence under **Section 26** of the POSH Act.

6. **Not maintaining statutory registers and minutes.** Even if the company has minimal activity, statutory registers (register of members, register of directors, minutes books) must be maintained from incorporation. Failure attracts penalties during MCA inspections or investor due diligence.

7. **Using personal accounts for business transactions.** A company has a separate legal identity. Mixing personal and company finances can lead to allegations of fraud, piercing of the corporate veil, and tax complications.

8. **Overlooking FEMA compliance for foreign funds.** Receiving foreign investment without proper share pricing, board resolutions, and RBI filings is a FEMA violation that can attract significant penalties.

---

Frequently Asked Questions

Can a startup operate as a sole proprietorship?

Yes, there is no legal bar on operating a startup as a sole proprietorship. However, a sole proprietorship does not provide limited liability, cannot raise equity investment, and is not eligible for DPIIT recognition under the Startup India scheme. Most serious startups prefer incorporating as a private limited company or LLP.

Is it mandatory to register for GST immediately after incorporation?

No. GST registration is mandatory only upon crossing the applicable turnover threshold or falling under the mandatory registration categories (such as inter-state supply or e-commerce sales). However, voluntary registration from inception is common among startups that deal with registered businesses for input tax credit benefits.

What is the penalty for not constituting an ICC under the POSH Act?

Under **Section 26** of the POSH Act, 2013, failure to constitute an Internal Complaints Committee or non-compliance with the provisions of the Act can attract a **fine up to Rs. 50,000**. Repeated violations can result in **higher penalties** and even **cancellation of the business licence or registration**.

Can a DPIIT-recognized startup claim both the Section 80-IAC tax holiday and other deductions simultaneously?

Section 80-IAC provides a deduction of 100% of profits for 3 consecutive years. This is a separate deduction and can be claimed alongside other business deductions. However, the total deductions under Chapter VI-A cannot exceed the gross total income. Additionally, startups must choose the 3 consecutive years strategically (when they are profitable) within the 10-year window.

Do labour laws apply to startups with fewer than 10 employees?

Basic employment protections apply regardless of headcount, including the **Payment of Wages Act, 1936**, **Minimum Wages Act, 1948**, and contract law principles. The **EPF Act** threshold is 20 employees, the **ESI Act** threshold is 10 employees, and the **POSH Act** ICC requirement applies at 10 employees. Below these thresholds, some registrations are not mandatory, but the underlying legal obligations (such as payment of minimum wages and prevention of harassment) still apply.

What happens if the startup fails to file annual returns?

Failure to file annual returns (Form AOC-4 and Form MGT-7) with the MCA attracts **additional fees of Rs. 100 per day of delay** for each form. Continued non-compliance can result in the company being struck off from the register under **Section 248** of the Companies Act, 2013, and directors may be disqualified under **Section 164(2)**, preventing them from serving as directors in any other company for a period of 5 years.

Is DPDPA compliance mandatory for startups from day one?

The DPDPA, 2023 applies to all entities that process digital personal data within India, regardless of size. There is no exemption for startups based on revenue or employee count. The Central Government may notify certain categories of data fiduciaries as **"significant data fiduciaries"** who face additional obligations (such as appointing a Data Protection Officer and conducting Data Protection Impact Assessments), but the baseline obligations — consent, notice, security safeguards, and breach notification — apply to all.

Can a foreign national be a co-founder of an Indian startup?

Yes. A foreign national can be a director and shareholder of an Indian private limited company. However, at least **one director must be an Indian resident** (Section 149(3), Companies Act, 2013). The foreign national's investment must comply with **FEMA regulations** and sectoral FDI caps. A valid passport and foreign address proof are required for DIN and DSC applications.

---

Conclusion

Legal compliance is not a one-time activity but an ongoing discipline that grows with the startup. From the foundational decision of choosing a business structure to the recurring obligations of tax filings, board meetings, labour law compliance, and data protection, each element plays a role in building a credible, investable, and sustainable business.

The Startup India framework offers meaningful benefits — including tax holidays, self-certification, and expedited IP examination — but accessing these benefits requires proactive DPIIT registration and adherence to eligibility criteria. Founders who invest time in understanding their legal obligations early are better positioned to focus on growth without regulatory disruptions.

This article provides a general overview based on the law and procedures as of the date of publication. Statutory provisions, government portal processes, and fee structures are subject to periodic changes. Readers should verify the latest requirements on the relevant government portals — [MCA](https://www.mca.gov.in), [Startup India](https://www.startupindia.gov.in), [GST Portal](https://www.gst.gov.in), [IP India](https://ipindia.gov.in) — and seek professional guidance tailored to their specific circumstances.