Payroll Outsourcing for Startups in India – What Founders must know

Get in touch with us

    Your information is confidential and secure

    Get in touch with us

      Your information is confidential and secure

      AI Summary

      Payroll outsourcing is essential for startups in India, especially as headcount grows. As compliance requirements increase with more employees, founders often underestimate the complexity involved. Key components include contributions to Provident Fund, Employee State Insurance, and accurate TDS deductions, each with due dates and penalties for non-compliance. Managing payroll can become overwhelming beyond a few employees, leading to significant risks if not addressed properly. Outsourcing payroll can reduce costs, mitigate compliance penalties, and streamline operational efficiency. Additionally, understanding the obligations under new Labour Codes and the Digital Personal Data Protection Act is crucial for safeguarding employee data. Choosing the right payroll provider can ensure compliance and significantly ease the burden on startup founders, especially during due diligence for investment rounds.

      Most founders treat payroll as a back-office task and give it to their CA. That works at three employees. By the time you have 15 people on payroll, you are managing a monthly compliance calendar spanning TDS under Section 192 of the Income Tax Act 1961 (and its successor the Income Tax Act 2025 from 01 April 2026), PF contributions under the Employees’ Provident Funds and Miscellaneous Provisions Act 1952, ESI under the Employees’ State Insurance Act 1948, state-specific Professional Tax, and a significantly altered salary structure obligation under the Code on Wages 2019 (in force from 21 November 2025). Treelife advises growing startups across every stage from incorporation to Series B, and the payroll question comes up at almost every VCFO engagement we run. The answer is not the same for every company, but the cost of getting it wrong compounds every month you delay the decision.

      What does Indian payroll compliance actually involve?

      Payroll compliance in India is not a single act. It is a framework of central and state obligations, each with its own applicability threshold, contribution rate, due date, and penalty structure.

      The core obligations every employer must manage are:

      • PF: Employee and employer each contribute 12% of basic salary plus DA. Deposits due by the 15th of the following month. Delayed payment attracts 12% annual interest plus damages up to 25% of arrears under Paragraph 32B of the EPF Scheme 1952.
      • ESI: Applicable to establishments with 10 or more employees where any employee earns up to ₹21,000 per month. Employer contributes 3.25%, employee contributes 0.75%. Due date is the 15th of the following month. Non-payment triggers prosecution under Sections 85(a) and 85A of the ESI Act 1948.
      • TDS on salary: Deducted monthly under Section 192 of the Income Tax Act and deposited by the 7th of the following month. Late deduction attracts 1% interest per month; late deposit attracts 1.5% per month. Under the Income Tax Act 2025 (applicable from 01 April 2026), Form 24Q is replaced by Form 138 and Form 16 is replaced by Form 130. Any payroll provider whose filing systems have not been updated to these new forms is already non-compliant.
      • Professional Tax: State-level, typically capped at ₹2,500 per year per employee, but applies in 18 states and union territories with different slabs and filing deadlines. Delhi does not levy it. Karnataka, Maharashtra, and Tamil Nadu do.
      • Labour Welfare Fund: Contribution amounts are nominal, but non-compliance triggers disproportionate penalties at the state level.
      • Gratuity: Payable after 5 years of continuous service under the Payment of Gratuity Act 1972 for most employees. Under the Code on Social Security 2020 (in force from 21 November 2025), fixed-term employees become eligible after just one year.

      The compliance calendar runs every single month without pause. Any month where headcount changes, any salary revision, any employee joining or exiting adds fresh complexity. The moment you cross two or three of these thresholds simultaneously, as most 15-to-25-person startups have, the in-house workload shifts from manageable to genuinely risky.

      Table 1: Payroll compliance due dates and penalty summary

      ObligationApplicable fromDue dateLate payment penalty
      PF deposit20 employees (mandatory)15th of following month12% interest + up to 25% damages
      ESI deposit10 employees, salary ≤ ₹21,000/month15th of following month12% interest + prosecution risk
      TDS deposit1st employee7th of following month1.5%/month interest
      TDS return (Form 138)1st employee31st July, 31st Oct, 31st Jan, 31st May₹200/day up to TDS amount
      Form 130 (replaces Form 16)1st employee15 June₹100/day under IT Act 2025
      Professional TaxState-specificState-specificState-specific interest and penalty
      Gratuity (fixed-term staff)1 year of service (Code on SS 2020)On separationLiability plus 10% interest p.a.

      What does in-house payroll actually cost?

      The honest number is not just the salary of whoever runs payroll. It includes software, compliance costs, error correction, and the number most founders never see: the time cost.

      According to Confederation of Indian Industry (CII) data, Indian SMEs managing payroll internally spend an average of 40 hours per month on payroll-related tasks. At a senior finance associate’s fully loaded cost of ₹60,000 to ₹90,000 per month in a Tier-1 city, that 40-hour allocation represents a significant share of a salaried resource that should be doing something more valuable.

      The table below maps the realistic total cost at three headcount bands. These figures include the salary allocation of the person managing payroll, payroll software, CA fees for filings, and an annualised provision for penalties based on what Treelife observes in compliance audits at onboarding.

      Table 2: True total cost of in-house payroll versus outsourced payroll

      Cost component10 employees30 employees75 employees
      HR/finance staff time allocation₹8,000 – ₹15,000₹20,000 – ₹35,000₹45,000 – ₹65,000
      Payroll software licence₹1,000 – ₹3,000₹3,000 – ₹6,000₹5,000 – ₹10,000
      CA / compliance fees₹4,000 – ₹8,000₹8,000 – ₹15,000₹15,000 – ₹25,000
      Annualised penalty provision₹3,000 – ₹6,000₹8,000 – ₹20,000₹20,000 – ₹45,000
      Total in-house (per month)₹16,000 – ₹32,000₹39,000 – ₹76,000₹85,000 – ₹1,45,000
      Outsourced payroll (market rate)₹6,000 – ₹10,000₹12,000 – ₹22,000₹25,000 – ₹45,000

      The penalty provision in the in-house column is not theoretical. A 2024 Deloitte India survey found that 62% of Indian SMEs managing payroll internally reported at least one compliance penalty in the preceding 12 months, compared to 8% for those using professional payroll outsourcing providers. At Treelife, when we onboard a startup for VCFO services and review their payroll history, we find incorrect TDS calculations, or missed Professional Tax filings in the majority of cases where payroll was managed ad hoc.

      The penalty provision is also conservative. It does not include the cost of a retrospective PF gap settlement, which can run into several lakhs once interest and damages compound over 8 to 12 months. It does not include the cost of a short-deduction notice from the income tax department, or the management time consumed by a labour inspector visit.

      What are the five compliance risks that compound silently?

      These are not dramatic failures. They are quiet gaps that grow into significant numbers by the time someone discovers them.

      1. PF deducted but never deposited

      This is not a civil liability. Under Section 14 of the EPF Act 1952, an employer who deducts PF from an employee’s salary and fails to deposit it with EPFO is liable for criminal prosecution, not just a fine. Directors can face imprisonment of up to one year plus a fine. Employees have a right to check their EPFO passbook at any time. When they discover the gap, especially during a job change, the founder faces both regulatory action and a serious employee relations problem. More than one Indian startup has had to inject capital to clear PF arrears before a funding round could close.

      2. Incorrect salary structure increasing PF and gratuity liability

      Most startups structure salaries with a low basic pay and high special allowances to minimise PF deductions. This is common and was previously tolerated. The Code on Wages 2019, in force from 21 November 2025, requires basic wages to constitute at least 50% of gross wages. Exclusions like HRA, overtime, and bonus are capped at 50% of total remuneration. Any excess is treated as wages for PF, gratuity, ESI, bonus, and leave encashment calculations. A startup currently running basic pay at 20 to 25% of CTC will need to restructure, and every month of delay increases the gap between what should have been contributed and what was actually contributed.

      3. ESI applicability missed

      Founders often remember PF and TDS. ESI gets missed. The applicability threshold is 10 or more employees where any employee earns up to ₹21,000 per month. Most product startups with 12 to 15 employees have at least a few team members, interns, or operations staff under this salary ceiling. If ESI registration is not done from the date of applicability, the startup faces retrospective liability plus interest from that date, not from the date of registration.

      4. TDS calculation errors on variable pay and ESOP exercise

      TDS under Section 192 is calculated on estimated annual income. Variable components, bonuses, and ESOP perquisites exercised during the year can shift an employee’s tax slab mid-year. If the employer has not been collecting updated Form 12BB declarations and adjusting TDS monthly, the year-end adjustment creates a large single-month deduction that employees dispute, and a potential short-deduction notice from the income tax department. ESOP exercise events, in particular, are frequently miscalculated by payroll setups that were not designed with equity compensation in mind.

      5. Exit compliance failures triggering dispute

      Under the Code on Social Security 2020 (in force from 21 November 2025), fixed-term employees are now eligible for gratuity after one year of continuous service, reduced from the earlier five-year threshold under the Payment of Gratuity Act 1972. A startup that routinely contracts employees on fixed-term agreements and was relying on the five-year rule to avoid gratuity obligations now has a significantly different liability profile. Full and final settlement must also happen within two working days of an employee’s exit under the new Codes. A settlement processed a week late is no longer just an HR oversight; it is a statutory non-compliance.

      How do the new Labour Codes change the payroll equation for startups?

      The four Labour Codes came into force on 21 November 2025, replacing 29 older statutes. The four are the Code on Wages 2019, the Code on Social Security 2020, the Industrial Relations Code 2020, and the Occupational Safety, Health and Working Conditions Code 2020. Central and state rules are still being notified through 2026, which itself creates a compliance challenge: you are legally bound by the Codes, but some operational rules are still pending.

      The changes that immediately affect startup payroll are:

      • The 50% basic wage rule. Under the Code on Wages 2019, basic pay must be at least 50% of gross wages. This restructures PF and gratuity contribution bases for any startup with a low-basic salary architecture. The higher PF base increases employer cost directly.
      • Gratuity after one year for fixed-term employees. This changes the economics of contract and project-based hiring fundamentally. Any company that uses fixed-term or project contracts needs to provision gratuity from Year 1 of any engagement.
      • Mandatory appointment letters for all workers. Under the Industrial Relations Code 2020, every worker including gig, fixed-term, and contract staff must receive a formal appointment letter detailing job role, wages, working hours, and employment classification. Startups that have been onboarding team members informally are non-compliant from the date the Codes took effect.
      • Unified wage definition across all four Codes. Where different laws previously used different definitions of wages, the Codes standardise the definition, affecting how PF, gratuity, ESI, bonus, and leave encashment are calculated.
      • Digital record-keeping obligation. Employers must maintain wage registers, muster rolls, and other payroll records in prescribed digital formats, subject to audit at any time.
      • Reskilling Fund contribution on retrenchment: equal to 15 days’ last drawn wages per retrenched worker.

      An in-house payroll setup that was compliant under the old regime may be non-compliant today. A managed payroll provider whose systems have been updated to the new Codes offers significantly better risk coverage during this transition period, but you should verify that the update has actually happened before assuming it.

      What is the contractor misclassification risk, and why does it show up in payroll?

      This is a gap most payroll guides do not cover. Many early-stage startups build the first 10 to 20 members of their team through a mix of full-time employees and contractors, consultants, or freelancers. This is sensible from a flexibility standpoint. It becomes a payroll and compliance problem when the contractor relationship, in practice, looks like employment.

      Under Indian labour law, the classification of a worker as a contractor versus an employee depends on control, economic dependency, and the nature of the work. A developer who works exclusively for your startup, on your systems, under your direction, for 12 months, is likely to be treated as an employee by a labour authority even if you have a consulting agreement in place. The consequences of misclassification are significant: retrospective PF and ESI liability from the date of the relationship, plus interest and damages; potential prosecution under the Contract Labour (Regulation and Abolition) Act 1970; and, under the new Labour Codes, social security and wage protections that extend to gig and platform workers as well.

      The Code on Social Security 2020 explicitly expands coverage to gig workers, platform workers, fixed-term employees, and certain categories of contract workers. A startup that has been paying freelancers without a structured assessment of classification risk is carrying a liability it has probably not modelled.

      A good payroll provider or VCFO partner flags these classification risks as part of payroll setup. A CA managing payroll from Excel will generally not.

      The DPDP Act: what happens to your employee data when you outsource payroll?

      This is another area the payroll outsourcing conversation almost never addresses. When you hand employee salary, PAN, Aadhaar, bank account details, and leave data to a third-party payroll provider, you are sharing personal data of your employees with a data processor. Under the Digital Personal Data Protection Act 2023 (DPDP Act), your obligations as a data fiduciary do not end at the point of handoff.

      The DPDP Act’s compliance deadline is 13 May 2027. The Data Protection Board was established in November 2025. While full enforcement is not yet active, organisations are expected to be building compliant frameworks now. For payroll data specifically:

      • You must have a valid legal basis for sharing employee personal data with a payroll provider. Employment contracts and payroll processing are a reasonable basis, but the basis should be documented.
      • Your agreement with the payroll provider must include data processor obligations: what data they receive, how it is stored, for how long, what access controls apply, and what happens on contract termination.
      • Employee personal data should not be shared beyond what is strictly necessary for payroll processing. Bulk data exports to a provider who stores everything indefinitely creates unnecessary risk.
      • If a payroll provider has a data breach that exposes your employees’ Aadhaar, PAN, or salary information, you as the data fiduciary bear the primary accountability.

      The practical implication is simple: when evaluating a payroll provider, ask for their data processing agreement (DPA) or ask them to sign your DPA. A provider that cannot produce one, or has never heard of the DPDP Act, is not a safe choice for handling sensitive employee financial data in 2026.

      What is the real decision: a framework by headcount and stage

      The choice between in-house and outsourced payroll is not binary, and it changes at each growth stage.

      Under 10 employees

      At this stage, a CA managing monthly payroll with a basic payroll software that has a free or low-cost tier is a reasonable arrangement. The compliance calendar is manageable. The critical non-negotiable is getting salary structures right from the first hire: basic pay at or above 50% of CTC to comply with the Code on Wages, correct TDS declarations from Day 1, and PF registration before crossing the 20-employee threshold.

      10 to 30 employees

      This is where most founders underestimate complexity. You have crossed or are near the ESI threshold. You have multiple salary structures. TDS calculations vary significantly employee to employee. PF challans go out monthly. At this band, the cost comparison in Table 2 strongly favours outsourcing. A managed payroll provider at market rates covers the full compliance calendar and removes the founder or office manager from the monthly payroll loop.

      30 to 100 employees

      At this stage, payroll is not just a compliance function but a data function feeding into ESOP tracking, financial modelling, and investor reporting. You need a system that generates clean payroll reports, integrates with your accounting software, and can produce audit-ready records on demand. A CA managing payroll without a proper HRMS fails here. An integrated HRMS platform with managed payroll, or a VCFO-led setup with Treelife managing both the payroll compliance and the financial reporting layer, is the right fit.

      Above 100 employees

      You need an in-house payroll or HR ops person alongside a professional payroll system. The outsourcing question shifts from “should we outsource” to “how do we structure the handoff between internal HR and the payroll platform.” At this scale, business continuity becomes relevant: what happens if your payroll manager resigns the week before salary day? A managed payroll partner removes that single-point-of-failure risk.

      What does a hybrid payroll model look like?

      The hybrid model is increasingly common for startups between 50 and 150 employees. The company uses SaaS payroll software and processes salaries using its own HR team, but hands over all statutory filings to an external firm. The external firm manages PF/ESI portal submissions, TDS quarterly returns, state-specific Professional Tax, Form 130 generation, and inspection readiness.

      This separation works well when the HR team is strong on the people side but not on the regulatory side. The external firm does not need to know every employee’s leave balance. They need clean payroll data by the 5th of each month and a clear brief on any structure changes. The hybrid model is becoming the standard for 50- to 100-employee companies that have crossed both PF and ESI thresholds but do not yet have a full compliance function in-house.

      The one risk in a hybrid setup is data handoff quality. If the payroll software output is messy (wrong month inputs, missing new joiners, unreconciled full and final settlements), the external filing firm cannot compensate for upstream errors. The clean split only works if the internal payroll processing discipline is strong.

      What questions should you ask before signing with a payroll provider?

      This is the section most founders skip, and the one that protects them. Signing with a payroll provider on the basis of price and a demo is how you end up with a vendor who has not updated to the new Income Tax Act 2025 forms, cannot handle multi-state Professional Tax, and has no DPA for employee data.

      Before committing, get answers to the following:

      On compliance currency:

      • Have you updated your system to use Form 138 and Form 130 under the Income Tax Act 2025 for all salary TDS filings from 01 April 2026?
      • How do you handle the Labour Code 50% basic wage rule in salary structuring? Do you flag non-compliant structures at setup?
      • Can you manage Professional Tax in the specific states where our employees are located?

      On accountability:

      • Do you carry professional indemnity insurance? What is the coverage amount and does it apply to statutory penalties arising from your processing errors?
      • What is your SLA for resolving a PF portal discrepancy or TDS short-deduction notice?
      • Who is accountable when a penalty notice arrives: you or us?

      On data security:

      • Can you provide a Data Processing Agreement that covers our obligations under the DPDP Act 2023?
      • Where is employee data stored, how long is it retained, and what are your breach notification protocols?
      • Do you have ISO 27001 certification or equivalent security audit documentation?

      On ESOP and variable pay:

      • Can your system handle perquisite TDS on ESOP exercise events under Section 17(2) of the Income Tax Act?
      • How do you handle mid-year bonus, variable pay, and salary revision adjustments in TDS calculations?

      On transition:

      • If we decide to switch providers, what is the data portability process? How long does transition take?

      A provider that cannot answer these questions clearly is not a safe choice for a growth-stage startup where payroll compliance is a diligence item at every funding round.

      Payroll compliance and investor due diligence: what investors actually look at

      Payroll compliance shows up in every Series A and Series B data room. Investors and their legal counsel run a statutory compliance questionnaire as part of employment law diligence, and payroll is one of the highest-scrutiny areas.

      The typical items requested are:

      • 12 to 24 months of payroll registers and payslips for all employees
      • PF deposit challans and EPFO portal ECR filings for the same period
      • ESI deposit confirmations and half-yearly returns
      • TDS challan history and Form 138 (or Form 24Q for periods before 01 April 2026) for all relevant quarters
      • Form 130 or Form 16 issued to employees for the last two financial years
      • Professional Tax registration certificates and filing history for each relevant state
      • Salary structure documentation showing CTC break-up for all current employees
      • Evidence of compliance with the Code on Wages 50% basic wage rule
      • Appointment letters for all employees confirming employment classification

      Missing PF filings, inconsistent payslips, unreconciled TDS, wage registers that do not match ECR data, or salary structures non-compliant with the new Codes are all red flags that delay transactions. More than one Indian startup has quietly had to inject capital to clear compliance arrears before a funding round could close.

      A startup that has been running outsourced payroll through a credentialed provider from an early stage will have clean, HRMS-backed payroll records, automated filing confirmations, and a clear audit trail. That materially reduces diligence friction. A startup that has been managing payroll through Excel and a CA without systematic records will face several uncomfortable weeks of reconstruction before the data room is clean.

      The point is not just compliance for its own sake. It is that payroll records are evidence of how seriously the founders take financial governance. Investors read them that way.

      Case study

      Situation: Seed-stage SaaS startup, Bengaluru, 22 employees. CA managing payroll via Excel, no HRMS in place.

      Challenge: Investor due diligence flagged three issues: PF not registered (threshold crossed 8 months prior), TDS calculations for two ESOP-exercising employees incorrect, salary structures showing basic pay at 18% of CTC (non-compliant with the new wage rule). Estimated retrospective PF liability: ₹4.2 lakhs plus interest.

      What Treelife did: Modelled the cost of immediate restructuring versus phased transition on salary structures. Managed the PF retrospective registration and gap filing with EPFO. Set up a proper HRMS with correct salary structure templates. Coordinated handoff to a managed payroll provider for ongoing filings.

      Outcome: Retrospective PF liability settled at ₹4.2 lakhs plus ₹61,000 interest. Investor due diligence cleared within 6 weeks of engagement. Equivalent total in-house compliance cost going forward: estimated ₹38,000 per month versus the outsourced arrangement.

      FAQ on Payroll Outsourcing Services for Startups

      Q: At what employee count should an Indian startup register for PF?
      A: PF registration is mandatory once you reach 20 employees under the EPF Act 1952. Registration must happen immediately upon crossing the threshold, not when convenient. Once registered, the obligation applies permanently even if headcount later falls below 20. A startup that misses the registration date faces retrospective liability from the date of applicability, not from the date of registration.

      Q: Does outsourcing payroll transfer the legal liability for compliance errors?
      A: No. The employer remains the legal entity responsible for all statutory filings. What a professional payroll provider does is shift the operational risk. If the provider makes an error, a reputable firm will cover the resulting penalty from its professional indemnity insurance. You should verify that any provider you engage carries this coverage and that your contract specifies the accountability clearly.

      Q: How do the new Labour Codes change salary structuring for startups?
      A: The Code on Wages 2019, in force from 21 November 2025, requires basic wages to be at least 50% of gross wages. For a startup currently running basic at 20 to 25% of CTC to minimise PF, this requires restructuring. The restructuring increases both employer and employee PF contributions, which increases cash-out for the company and reduces employee take-home unless gross CTC is revised upward. The full state-level implementation rules are still being notified through 2026, but the obligation is live at the central level.

      Q: Can our CA handle payroll for a 40-person startup?
      A: A CA can handle the compliance filings (PF, ESI, TDS returns, Form 130) for a 40-person startup. What a CA typically cannot provide is a proper HRMS, employee self-service for payslips and tax declarations, real-time salary structure modelling, ESOP perquisite TDS tracking, or the monthly operational bandwidth to catch mid-month changes and variable pay adjustments accurately. The combination of a CA for compliance filings plus payroll software for processing works better than either alone, but a managed payroll provider covers both more cleanly.

      Q: What happens if we deduct PF from employees but do not deposit it with EPFO?
      A: This is a criminal offence under Section 14 of the EPF Act 1952, not just a civil penalty. The founder and other directors can face imprisonment of up to one year plus a fine. Employees can check their EPFO passbook and raise a complaint directly with EPFO. This is the single most serious payroll compliance risk and it is more common in early-stage startups than most founders realise.

      Q: Is gratuity applicable to startups?
      A: Yes. The Payment of Gratuity Act 1972 applies to establishments with 10 or more employees. An employee who completes 5 years of continuous service is entitled to gratuity at 15 days’ salary per year of service, subject to a maximum of ₹25 lakhs. Under the Code on Social Security 2020 (in force from 21 November 2025), fixed-term employees become eligible after just one year. Startups using fixed-term contracts need to provision for this from Year 1 of any such arrangement.

      Q: What payroll data does an investor ask for during due diligence?
      A: Typically, 12 to 24 months of payroll registers, PF deposit challans, ESI confirmation, TDS challan history, Form 138/Form 24Q filings, and salary structure documentation for all employees. Gaps, retrospective corrections, or structures non-compliant with the new Codes are red flags that delay transactions.

      Q: How does payroll outsourcing handle multi-state compliance for a remote-first startup?
      A: A managed payroll provider with multi-state capability manages Professional Tax registration and filing in each state where employees are based, makes sure state-specific minimum wage compliance is maintained, and handles variations in ESI applicability and Labour Welfare Fund contributions across states. For a remote-first startup with employees in 5 or 6 states, this is one of the most compelling arguments for outsourcing. A CA or single in-house manager rarely tracks state-level updates consistently across all relevant jurisdictions.

      Q: What is the right payroll setup for a startup that has just raised its first round?
      A: At post-seed with 10 to 30 employees, the priority is getting the foundational structure right: salary architecture compliant with the 50% basic wage rule, PF and ESI registrations in place, a proper HRMS for records, and a managed payroll provider or VCFO partner handling the monthly compliance calendar. The cost is modest relative to the liability being eliminated, and the audit-ready payroll history makes subsequent fundraising diligence significantly cleaner.

      Q: Can we switch payroll providers if we are unhappy?
      A: Yes. Switching involves migrating historical payroll data, maintaining continuity on PF/ESI UAN numbers, transferring statutory filing history, and onboarding employees to the new self-service portal. A clean transition takes 4 to 6 weeks. The barrier to switching is low enough that being locked in is not a reason to stay with a provider that is underserving you.

      Q: Does outsourcing payroll affect ESOP administration?
      A: Payroll and ESOP administration overlap at the point of exercise. When an employee exercises options and acquires shares, the perquisite value is added to taxable income and TDS must be deducted under Section 17(2) read with Section 192 of the Income Tax Act. A payroll provider that has not handled ESOP exercise events before will miscalculate TDS in the exercise month, creating a short-deduction notice. Treelife manages both ESOP structuring and payroll compliance as part of its VCFO mandate, which closes this gap.

      Q: What are our obligations under the DPDP Act when sharing employee data with a payroll provider?
      A: Under the Digital Personal Data Protection Act 2023, you remain the data fiduciary for your employees’ personal data even after sharing it with a payroll provider. You must have documented legal basis for the data sharing, a Data Processing Agreement (DPA) with the provider, and an agreement on data retention, access controls, and breach notification. Full enforcement under the DPDP Act applies from 13 May 2027, but building compliant data-sharing arrangements now protects you from retrospective liability.

      Regulatory references

      • Employees’ Provident Funds and Miscellaneous Provisions Act 1952, Sections 6, 14; Paragraph 32B of the EPF Scheme 1952
      • Employees’ State Insurance Act 1948, Sections 85(a) and 85A
      • Income Tax Act 1961, Sections 192, 200, 234E, 272A(2)(g) (applicable for periods up to 31 March 2026)
      • Income Tax Act 2025, applicable from 01 April 2026; Form 138 replaces Form 24Q; Form 130 replaces Form 16
      • Payment of Gratuity Act 1972, Section 4
      • Contract Labour (Regulation and Abolition) Act 1970
      • Code on Wages 2019, in force from 21 November 2025 (50% basic wage rule)
      • Code on Social Security 2020, in force from 21 November 2025 (gratuity for fixed-term employees after 1 year; gig worker coverage)
      • Industrial Relations Code 2020, in force from 21 November 2025 (mandatory appointment letters; fixed-term employment)
      • Occupational Safety, Health and Working Conditions Code 2020, in force from 21 November 2025
      • Digital Personal Data Protection Act 2023; DPDP Rules 2025; enforcement deadline 13 May 2027

      External sources:

      About the Author
      Treelife
      Treelife social-linkedin
      Treelife Team | support@treelife.in

      We are a legal and finance firm with a deep focus on the startup ecosystem. We offer a wide range of services, including Virtual CFO, Legal Support, Tax & Regulatory, and Global Expansion assistance.

      Our goal at Treelife is to provide you with peace of mind and ease in business.

      We Are Problem Solvers. And Take Accountability.

      Related Posts

      How Startup Valuation works in India: Methods, Metrics, Strategies
      How Startup Valuation works in India: Methods, Metrics, Strategies

      Startup valuation in India sits at the intersection of deal economics, regulatory compliance, and tax law. Most founders think of...

      Learn MoreLearn More
      Compliance Calendar June 2026 – GST TDS PF ESI Deadlines
      Compliance Calendar June 2026 – GST TDS PF ESI Deadlines

      Plan your June filings in one place. Figures and forms are mapped for monthly GST filers, QRMP taxpayers, TDS deductors,...

      Learn MoreLearn More
      Sweat Equity in India: Eligibility, Restrictions, Tax Treatment
      Sweat Equity in India: Eligibility, Restrictions, Tax Treatment

      Sweat equity shares are one of the most misused instruments in the Indian equity toolkit. Companies reach for them when...

      Learn MoreLearn More

      For Customer Support

      Mumbai | Delhi |
      Bangalore | GIFT City

      Speak to Us!

      We respond within 60 minutes.

        Your information is confidential and secure

        Let's talk.

        We've seen most founder problems before. Tell us yours.






          Typically responds within 4 hours
          Or reach out directly