The 2026 Startup Legal Compliance Checklist Every Indian Founder Needs
· 9 min read · Regulatory Guide
From company incorporation to your first fundraise, here is every legal requirement Indian startups must meet in 2026 - including the new DPDP Act obligations most founders are missing.
If you advise startups, you know the pattern. A founder comes to you after their first fundraise with a stack of compliance gaps that should have been addressed at incorporation. Employment contracts missing. IP not assigned. DPDP Act obligations ignored. Board resolutions incomplete or non-existent. Tax registrations delayed.
The cost of fixing these gaps retrospectively is always higher than doing it right from the start. And in 2026, with the DPDP Act in force and investor due diligence becoming more rigorous, the compliance bar for startups has never been higher.
This checklist covers every legal requirement Indian startups must address - framed for the lawyers who advise them.
Incorporation: Private Limited vs LLP
The first decision shapes everything that follows. For startups planning to raise equity funding, a Private Limited Company under the Companies Act, 2013 is almost always the correct choice. LLPs cannot issue equity shares and cannot accommodate typical venture capital structures (preference shares, anti-dilution rights, liquidation preferences).
Choose LLP only for professional services firms, bootstrapped businesses with no equity fundraising plans, or situations where the pass-through taxation benefit is critical.
For Private Limited incorporation:
Minimum two directors (at least one must be an Indian resident - defined as someone who has stayed in India for at least 120 days in the preceding financial year).
Minimum two shareholders (can be the same as directors for a two-person startup).
Registered office address in India with proof of address (ownership document or NOC from owner plus utility bill).
Digital Signature Certificates for all directors.
Director Identification Numbers (DIN) for all directors.
Name approval through RUN (Reserve Unique Name) or SPICe+ form.
Incorporation through SPICe+ (Simplified Proforma for Incorporating Company Electronically Plus), which now combines incorporation, PAN, TAN, GSTIN, EPFO, and ESIC registration in a single application.
Authorised and paid-up share capital: Keep authorised capital at INR 10 lakh initially (stamps duty varies by state).
Immediate Post-Incorporation Compliance
Within 30 days of incorporation:
Open a current account in the company's name and deposit the subscription money.
Issue share certificates to initial subscribers.
Hold the first Board Meeting (must be within 30 days of incorporation).
Appoint the first auditor (within 30 days of incorporation, by Board resolution).
File INC-20A (Declaration for Commencement of Business) - this is mandatory before the company can commence any business activity.
Prepare and adopt the company's registers: Register of Members, Register of Directors, Register of Charges.
Tax Registrations
PAN and TAN: Automatically allotted through SPICe+ now, but verify receipt.
GST Registration: Mandatory if aggregate turnover exceeds INR 40 lakh (INR 20 lakh for services in special category states). For startups, register proactively even below threshold - most B2B clients require GST invoices regardless of turnover.
Professional Tax: State-specific. Required in Maharashtra, Karnataka, West Bengal, and several other states. Register within 30 days of hiring employees.
Shop and Establishment Registration: Required in most states for any business premises with employees. Timelines vary by state (typically within 30 days of commencing operations).
MSME Registration (Udyam): Optional but highly recommended. Provides benefits including priority sector lending, protection against delayed payments (MSMED Act), and government procurement preferences.
Employment Compliance
For startups hiring their first employees:
Employment Agreements: Every employee needs a written contract. At minimum: role, compensation, notice period, IP assignment, confidentiality, and non-solicitation clauses. Do not rely on offer letters alone - they are not comprehensive employment contracts.
Provident Fund (EPF): Mandatory once you have 20 or more employees. Contribution rate: 12% of basic salary from both employer and employee. Registration within 30 days of crossing the threshold.
Employees' State Insurance (ESI): Mandatory for employees earning up to INR 21,000 per month, once the establishment has 10 or more employees. Employer contribution: 3.25%. Employee contribution: 0.75%.
Gratuity: Payment of Gratuity Act applies to establishments with 10 or more employees. Gratuity becomes payable after 5 years of continuous service. No registration required, but liability accrues from the first employee's first day.
Sexual Harassment Policy: Mandatory under the POSH Act for all employers. Constitute an Internal Complaints Committee even with fewer than 10 employees (especially after the 2026 Supreme Court ruling expanding coverage). Display the policy prominently.
Intellectual Property Protection
For technology startups, IP is the primary asset:
Trademark Filing: File early. The first-to-file system means your brand name is not protected until you file, regardless of how long you have been using it. File in relevant classes (Class 9 for software, Class 42 for SaaS services, Class 35 for business services). Budget INR 15,000 to 25,000 for a straightforward application with professional fees.
IP Assignment Agreements: Every founder, employee, and contractor who creates anything for the startup must sign an IP assignment agreement. This is the single most common gap that creates problems during due diligence. Without signed assignments, the IP may legally belong to the creator, not the company.
Patent Strategy: For deep-tech startups, file provisional patent applications early to establish priority dates. India's patent regime requires the invention to be novel, involve an inventive step, and be capable of industrial application. Software per se is not patentable, but software with a technical effect may be.
Data Protection - DPDP Act Compliance From Day One
This is the requirement most 2026 startups are missing. The DPDP Act applies to every company that processes personal data - which means every startup with users, customers, or employees.
From day one, your startup needs:
Privacy Policy: A clear, accessible notice explaining what personal data you collect, why, how you use it, how long you retain it, and the data principal's rights.
Consent Architecture: Technical systems to collect, record, and manage consent. For digital products, this means consent pop-ups or flows that are specific (not bundled with terms of service), informed (plain language), and withdrawable (easy opt-out mechanism).
Data Processing Records: Maintain logs of what data you process, for what purpose, and on what legal basis.
Vendor Due Diligence: If you use third-party services that process user data (analytics, cloud hosting, payment processors), ensure contractual protections are in place.
Breach Response Plan: Even a two-person startup needs a documented plan for responding to data breaches within the 72-hour notification window.
Startup India Recognition
Register on the Startup India portal for benefits including:
Tax exemption under Section 80-IAC (three consecutive years of tax holiday out of the first ten years).
Self-certification for labour and environmental laws.
Fast-track patent examination.
Eligibility for Fund of Funds and government procurement relaxations.
Criteria: The entity must be incorporated as a Private Limited Company, Partnership Firm, or LLP; be less than 10 years old from incorporation; have annual turnover not exceeding INR 100 crore; and be working towards innovation or scalability.
ESOP Pool Setup
If you plan to hire senior talent with equity incentives:
Board resolution approving the ESOP scheme.
Special resolution by shareholders (requires 75% approval).
ESOP scheme document covering: eligibility, vesting schedule, exercise price, exercise window, termination provisions, and transfer restrictions.
Valuation report from a registered valuer for exercise price determination.
Annual ESOP disclosures in the Board's report.
Shareholder Agreements and Board Governance
Even a two-founder startup needs:
Founders' Agreement: Covering equity split, vesting schedules, roles, decision-making, exit scenarios, non-compete, and IP assignment.
Board Resolution templates for routine decisions (opening bank accounts, appointing signatories, approving contracts above threshold amounts).
Minutes of every Board meeting and general meeting - maintained from day one, not reconstructed later during due diligence.
Annual Compliance Calendar
Every year, the following is mandatory regardless of revenue or activity:
Annual Return (Form MGT-7): Within 60 days of the AGM.
Financial Statements (Form AOC-4): Within 30 days of the AGM.
Annual General Meeting: Within 6 months of the financial year end (by September 30 each year).
Income Tax Return: By October 31 (for companies requiring audit) or July 31 (others).
GST Annual Return (GSTR-9): By December 31 of the following year.
Director KYC (DIR-3 KYC): By September 30 every year for all directors.
For lawyers advising startups, this checklist represents a retainer opportunity. Most founders will not track these requirements themselves. A structured compliance service - reminders, filings, and periodic audits - is both valuable to the client and a stable revenue source for the firm.