India Entry Compliance Checklist for Foreign Companies: Complete Guide

When a foreign company enters India, it does not take on one compliance framework. It takes on seven simultaneously. Corporate law under the Companies Act, 2013 governs how the entity is formed and governed. Exchange control under the Foreign Exchange Management Act, 1999 governs every capital movement. Direct tax under the Income Tax Act, 2025 governs income, withholding, and cross-border pricing. GST governs every commercial transaction. Labour law governs every hire. Data protection under the Digital Personal Data Protection Act, 2023 governs every byte of customer or employee data. Sector-specific licensing governs what the company can actually do. Most foreign companies entering India receive expert advice on one or two of these domains. They discover the rest through penalty notices. This checklist covers all seven, organised not by domain but by when each obligation arises, so a CFO or legal counsel can see the full commitment before signing off on entry.

How the compliance load varies by entry structure

Before the checklist, one orientation point. The volume and type of obligations a foreign company takes on depends entirely on the entry vehicle it chooses. Jordensky’s 12-month compliance guide, FinPracto’s end-to-end checklist, and PerfectAccounting’s 12-month roadmap all default to the wholly owned subsidiary (WOS) and do not map how the obligation set changes for a branch office or liaison office. That matters because the tax rate difference alone (25.17% effective for a WOS versus approximately 35% for a branch office for AY 2026-27) changes the economics of compliance spend significantly, and the branch office carries RBI-specific obligations the subsidiary does not.

Compliance domain	WOS	Branch office	Liaison office
MCA / ROC filings	Full (AOC-4, MGT-7, board meetings, AGM)	Partial (annual accounts with RoC)	Minimal
FEMA (RBI) filings	FC-GPR, FC-TRS, FLA, advance reporting	AAC, FLA	AAC only
Income tax	Full (ITR-6, TDS, transfer pricing, Form 3CEB)	Full (as foreign company, higher rate)	Nil (no income)
GST	On all taxable supplies	On all taxable supplies	Nil (no revenue)
Labour law	Full (EPF, ESI, POSH, S&E, Professional Tax)	Full	Minimal
Data protection (DPDPA)	Full (if processing Indian personal data)	Full	Full (if any data processing)
Transfer pricing	Yes (all intercompany transactions)	Yes (if intercompany transactions)	No
SBO disclosure (BEN-2)	Yes	No	No

The WOS carries the highest obligation count. It is also the most tax-efficient structure for long-term operations in India, which is why more than 90% of operational foreign companies choose it (DPIIT Consolidated FDI Policy, 2020, as amended). The compliance load is the price of that efficiency. Everything below assumes the WOS structure unless noted.

The complete India entry compliance checklist

This table covers every statutory obligation a foreign-owned WOS must meet, from the moment the structure decision is made through the first full year of operations. Obligations are sequenced by when they arise.

Phase 1: Pre-incorporation (before the company is registered)

Obligation	What it is	Form / filing	Deadline	Penalty if missed
SBO identification	Map the natural-person beneficial owner of the Indian entity through the full parent chain. Mandatory for any entity where a foreign entity holds 25%+ voting rights.	BEN-1 notice to SBO (internal); Form BEN-2 to RoC post-incorporation	BEN-2 within 30 days of incorporation	INR 50,000 per day of continuing default (Section 90(10), Companies Act, 2013)
FDI route verification	Confirm whether your sector allows automatic route FDI and at what percentage cap. Check Press Note 3 (amended March 2026) if any beneficial owner is from a land-border country.	No filing; DPIIT FDI Policy review	Before remitting capital	Investment may be illegal if wrong route used; compounding under FEMA
FOCC classification analysis	If the Indian subsidiary will invest in other Indian companies, determine whether FOCC (Foreign-Owned or Controlled Company) classification applies and what FDI sectoral caps govern those downstream investments.	No filing; legal analysis	Before any downstream investment	FEMA contravention; penalty up to 3x amount involved (Section 13, FEMA 1999)
Name reservation	Reserve the company name via RUN service on the MCA portal.	RUN form	Before SPICe+ filing	Name rejected at incorporation
DSC procurement	Class 3 Digital Signature Certificate for all proposed directors.	DSC agency application	Before SPICe+ filing	Cannot file SPICe+ without DSC

Phase 2: Incorporation (Day 1 to Day 15 approximately)

Obligation	What it is	Form / filing	Deadline	Penalty if missed
Company incorporation	File SPICe+ (Simplified Proforma for Incorporating Company Electronically) to register the WOS with the RoC. MoA, AoA, DIN, PAN, TAN, EPFO, and ESIC registrations are generated simultaneously.	SPICe+ Part B	N/A (initiating step)	N/A
Statutory auditor appointment	Appoint the first statutory auditor within 30 days of incorporation. Cannot be waived.	Board resolution	Within 30 days of incorporation	Penalty under Section 139, Companies Act, 2013
First board meeting	Hold the first board meeting within 30 days of incorporation. Set out key governance decisions.	Board minutes	Within 30 days	Penalty under Section 173(1), Companies Act, 2013
Form BEN-2 (SBO disclosure)	File the Significant Beneficial Owner disclosure with RoC. This is separate from SPICe+ and not prompted by the MCA portal.	Form BEN-2	Within 30 days of incorporation	INR 50,000 per day of default (Section 90(10))
Bank account opening	Open an Indian current account with an Authorised Dealer Category I bank. Required before any capital remittance.	Bank KYC documents	Before capital remittance	Cannot receive foreign capital without an Indian account

Phase 3: Capital remittance and FEMA (within 60 to 90 days of incorporation)

Obligation	What it is	Form / filing	Deadline	Penalty if missed
Advance reporting of FDI receipt	Report receipt of the foreign remittance to RBI through the FIRMS portal before allotting shares. Separate from FC-GPR. This step is missed by almost every first-time entrant.	Advance reporting on FIRMS portal	Within 30 days of receipt of funds	FEMA contravention; penalty up to 3x amount or INR 2 lakh, whichever is higher
Share allotment	Allot shares to the foreign investor by board resolution. Must happen before the 60-day window from receipt of funds closes.	Board allotment resolution	Within 60 days of receipt of funds	Funds must be returned to investor; failure to return is a further contravention
Form FC-GPR	Report the share issuance to RBI. The 30-day clock runs from allotment date, not from remittance receipt. Each allotment resolution is a separate FC-GPR event. In multi-tranche rounds, each tranche creates its own 30-day window.	FC-GPR on FIRMS SMF	Within 30 days of each allotment	LSF = INR 7,500 + (0.025% x amount x days delayed). Percentage doubles every 12 months. Escalates to compounding (up to 3x amount) beyond 3 years.
Form BEN-2 (if not filed at incorporation)	File SBO disclosure if not completed in Phase 2.	Form BEN-2	Within 30 days of incorporation	INR 50,000 per day

Phase 4: Post-incorporation registrations (Month 1 to Month 3)

Obligation	What it is	Form / filing	Deadline	Penalty if missed
GST registration	Mandatory before first taxable supply, or when aggregate turnover crosses INR 20 lakhs (INR 10 lakhs in special category states).	REG-01 on GST portal	Before first taxable supply	Supply without registration is an offence; penalties under CGST Act, 2017, Section 122
Shops and Establishments registration	State-level registration required in the state of operations within 30 days of commencing business. Requirement and format vary by state.	State Labour Department	Within 30 days of commencement	State-specific penalty; typically INR 200 to INR 5,000 per day
Professional Tax registration	State-level tax on employed individuals. Rate and applicability vary by state.	State-specific	Within 30 days	State penalty
Import Export Code (IEC)	Mandatory before any import or export of goods or services. Issued by DGFT.	DGFT portal	Before first import/export transaction	Cannot clear customs or receive foreign remittance for services without IEC
POSH Internal Complaints Committee	Constitute an Internal Complaints Committee once headcount reaches 10 employees. Many companies miss this because they are watching for higher headcount thresholds from other Acts.	Board resolution constituting ICC	Before 10th employee joins	INR 50,000 first offence; INR 1 lakh repeat; criminal liability of employer (Section 26, POSH Act, 2013)
Sector-specific licences	Varies by sector: FSSAI for food, RBI licence for NBFCs, IRDAI for insurance, SEBI registration for portfolio management, etc.	Sector regulator application	Before commencing regulated activity	Operating without licence is a criminal offence under the relevant sectoral Act

Phase 5: Ongoing tax and withholding compliance (from Month 1, recurring)

Obligation	What it is	Form / filing	Deadline	Penalty if missed
TDS deduction and deposit	Deduct Tax at Source on all applicable payments: salary, contractor fees, rent, royalties, payments to non-residents. No minimum threshold.	Challan 281	By 7th of the following month	Interest at 1.5% per month plus penalty equal to TDS amount (Section 271C, ITA 1961)
TDS quarterly return (domestic)	Report all domestic TDS deductions.	Form 26Q	Within 31 days of quarter end	INR 200 per day (Section 234E)
TDS quarterly return (non-resident)	Report all TDS on payments to non-residents, including parent company fees.	Form 27Q	Within 31 days of quarter end	INR 200 per day (Section 234E)
DTAA documentation	Before each applicable cross-border payment to the parent, obtain: Tax Residency Certificate from the parent’s home-country tax authority, Form 10F filed by the foreign parent on India’s income tax portal, and a beneficial ownership declaration. Without these, TDS must be deducted at the domestic rate (20% to 40%) rather than the treaty rate (typically 5% to 15%).	TRC, Form 10F, declaration	Before each applicable payment	No penalty for missing the documents; consequence is mandatory TDS at domestic rate, not treaty rate. Recovery requires foreign parent to file an Indian return, which may create PE exposure.
Advance tax	Pay estimated tax liability in four instalments if annual tax liability exceeds INR 10,000.	Challan 280	15 June (15%), 15 September (45%), 15 December (75%), 15 March (100%)	Interest under Sections 234B and 234C, ITA 1961
EPF contribution	Employer contributes 12% of basic wages per employee to EPFO, applicable once establishment has 20 or more employees.	ECR challan on EPFO portal	By 15th of following month	Damages of 5% to 25% per annum on arrears plus prosecution under EPF Act, 1952
ESI contribution	Employer contributes 3.25% of gross wages, applicable for employees earning below INR 21,000 per month once establishment has 10 or more employees.	ESI challan	By 15th of following month	Interest and prosecution under ESI Act, 1948
Equalisation levy	2% on specified digital services provided by non-PE foreign companies to Indian residents.	Statement of specified services	30 June annually	Interest plus penalty equal to levy amount (Finance Act, 2016, Section 165)

Phase 6: Transfer pricing (from first intercompany transaction, annual documentation)

Every Indian company that transacts with a foreign associated enterprise (AE) is subject to transfer pricing rules under Chapter X of the Income Tax Act, 2025. There is no minimum threshold. The arm’s length obligation applies from the first rupee of the first transaction.

Obligation	What it is	Form / filing	Deadline	Penalty if missed
Arm’s length pricing	All intercompany transactions (management fees, software licences, seconded employee recharges, intra-group loans, royalties) must be priced as if between unrelated parties.	No separate filing; documented in TP study	Ongoing	TP adjustment plus 50% to 200% of tax on understated income (Section 270A, ITA 1961)
Transfer pricing documentation	Maintain a Local File documenting the nature of transactions, pricing method, and comparables. Required when aggregate international transaction value exceeds INR 1 crore.	Local File under Rule 10D, Income Tax Rules 1962	Maintained before Form 3CEB filing date	2% of international transaction value (Section 271AA, ITA 1961)
Form 3CEB	Accountant’s report certified by a Chartered Accountant on all international transactions. Mandatory irrespective of transaction value. One of the most commonly missed first-year filings for new subsidiaries.	Form 3CEB	31 October of assessment year	INR 1 lakh minimum (Section 271BA, ITA 1961)
Master File	Required if the MNE group’s consolidated revenue exceeds INR 500 crore and the Indian entity’s international transactions exceed INR 50 crore.	Form 3CEAA	31 October	2% of transaction value (Section 271AA)
Country-by-Country Report	Required if the MNE group’s global consolidated revenue exceeds INR 5,500 crore.	Form 3CEAD	12 months from group’s financial year end	INR 5 lakh (Section 271GB)

Phase 7: Annual statutory compliance (every financial year)

Obligation	What it is	Form / filing	Deadline	Penalty if missed
Annual General Meeting	Hold AGM within 9 months of the close of the first financial year, then within 6 months of every subsequent financial year close.	Board approval; AGM minutes	By 30/09 each year (first AGM by 30/12 of first FY close)	INR 1 lakh plus INR 5,000 per day (Section 99, Companies Act, 2013)
Financial statements with RoC (AOC-4)	File audited financial statements with the Registrar of Companies within 30 days of AGM.	Form AOC-4	Within 30 days of AGM	INR 100 per day per form (accumulates without cap for certain forms)
Annual return with RoC (MGT-7)	File annual return with the Registrar of Companies within 60 days of AGM.	Form MGT-7	Within 60 days of AGM	INR 100 per day per form
Income tax return	All Indian companies must file regardless of income or loss status. Companies with international transactions have a 31 October deadline.	ITR-6	31 October (if transfer pricing applies); 30 November otherwise	INR 5,000 late filing fee; loss cannot be carried forward if return is late
Tax audit	Mandatory if turnover exceeds INR 1 crore (INR 10 crores for predominantly digital-payment businesses).	Form 3CA-3CD	31 October	0.5% of turnover or INR 1.5 lakh, whichever is lower (Section 271B)
FLA Return	Annual RBI return on foreign liabilities and assets. Required every year the company has an outstanding FDI position, even if no new investment occurred in the year. This is missed by companies that file in year one and assume subsequent filings are only triggered by new investment.	FLA Return on RBI portal	15 July each year	INR 7,500 per default (FEMA, 1999)
DIR-3 KYC	Annual KYC for every director holding a DIN. Non-compliance deactivates the DIN, making it impossible for that director to sign any statutory filing.	DIR-3 KYC on MCA portal	30 September each year	DIN deactivated; INR 5,000 to reactivate
Board meetings	Minimum four board meetings per financial year, with no gap exceeding 120 days between consecutive meetings.	Board minutes	Throughout the year	INR 25,000 per director in default (Section 173, Companies Act, 2013)
GSTR-9 (annual GST return)	Annual reconciliation of GST filings. Mandatory for turnover above INR 2 crores. GSTR-9C (reconciliation statement) additionally required above INR 5 crores.	GSTR-9 / GSTR-9C	31 December of the following year	INR 200 per day (INR 100 CGST + INR 100 SGST) subject to maximum of 0.25% of turnover
POSH annual report	Annual report on POSH compliance submitted to the District Officer by every company with a constituted Internal Complaints Committee.	Form as prescribed	By 31 January each year	INR 50,000 first offence; INR 1 lakh repeat (Section 26, POSH Act, 2013)

Phase 8: Data protection (phased, building to full compliance by 13/05/2027)

The Digital Personal Data Protection Act, 2023 applies to any entity processing digital personal data within India, and to any foreign company processing Indian residents’ data in connection with offering goods or services to them, regardless of where the company is incorporated (Section 2(i), DPDPA, 2023). The DPDP Rules, 2025 were notified by MeitY on 13/11/2025. Hogan Lovells’ November 2025 analysis confirms the old IT (SPDI) Rules, 2011 remain in force in parallel until Phase 3 is complete.

Obligation	What it is	Effective date	Penalty if missed
Data Protection Board constituted	Enforcement body established. Complaints can be filed from this date.	13/11/2025 (in force)	Board operational
Consent Manager registration opens	Entities acting as intermediaries between data principals and fiduciaries must register.	13/11/2026	TBD by Board
Consent notices	Obtain specific, informed, unambiguous consent before processing personal data.	13/05/2027	Up to INR 250 crores (Section 33, DPDPA 2023)
Breach notification	Notify the Data Protection Board and affected individuals of every personal data breach, regardless of severity.	13/05/2027	Up to INR 200 crores
Security safeguards	Implement reasonable technical and organisational measures appropriate to the risk.	13/05/2027	Up to INR 250 crores
Data principal rights	Enable individuals to access, correct, and erase their personal data on request.	13/05/2027	Up to INR 150 crores
Data processor contracts	Bind all vendors processing data on the company’s behalf to DPDPA-compliant terms.	13/05/2027	Part of fiduciary’s accountability
Cross-border transfer review	Verify that data transfers to the parent company comply with the government-notified country list (to be published in 2026).	13/05/2027	Up to INR 250 crores
Data Protection Officer appointment	Required only for entities designated as Significant Data Fiduciaries. Criteria to be published by the government in 2026.	On SDF designation	INR 50 crores

GDPR compliance does not satisfy DPDPA. As McDermott Will and Emery noted in December 2025, the DPDPA’s legitimate-use categories are structurally narrower than GDPR’s legitimate interest basis, and US or EU companies will need India-specific consent addenda to their existing data processing agreements.

The six compliance triggers that most foreign companies miss entirely

Jordensky, FinPracto, PerfectAccounting, and Fintrac Advisors all cover the headline filings. These six are the ones that appear in penalty notices, not checklists.

1. The advance reporting obligation before FC-GPR. When the foreign parent wires capital to the Indian subsidiary, a 30-day reporting window opens immediately on the FIRMS portal, before any shares are allotted. This is separate from Form FC-GPR, which runs from allotment date. Most companies know about FC-GPR. Almost none file the advance report on time. Two contraventions from one transaction.

2. Form BEN-2 is not part of SPICe+. The MCA portal does not prompt for it. The RoC does not send a reminder. It must be filed within 30 days of incorporation as a separate action. For PE-backed or multi-tier parent structures, the SBO identification itself requires a legal analysis before filing. The penalty is INR 50,000 per day from the date the default begins.

3. FLA Return is annual, not transactional. Companies file the Foreign Liabilities and Assets return in year one because they remember receiving the FDI. They stop in year two because no new investment arrived. The filing obligation persists every year the company has any outstanding FDI position on its balance sheet. Missing it is INR 7,500 per default and creates a FEMA compliance gap that surfaces in funding due diligence.

4. Each allotment date is a separate FC-GPR event. In a multi-tranche round where three investors close on different dates, there are three FC-GPR filing windows, each triggered by the specific allotment board resolution. Companies that wait for the round to fully close and file one consolidated FC-GPR are late on the first allotment. R Pareva and Company report this is the most common single pattern in FEMA compounding cases they handle.

5. DTAA documentation must be in place before the first cross-border payment. If the TRC and Form 10F from the foreign parent are not filed before the first management fee or software licence payment to the parent, the Indian subsidiary is obligated to deduct TDS at the domestic rate. The excess TDS can only be recovered by the foreign parent filing an Indian income tax return, which may create a permanent establishment argument that costs far more than the original TDS differential.

6. Form 3CEB applies from the first intercompany transaction, regardless of revenue. A pre-revenue subsidiary that pays a management fee or licence fee to its parent has an international transaction and must file Form 3CEB by 31 October. Many first-year subsidiaries discover this for the first time when their tax auditor raises it during year-end accounts.

What each penalty actually costs: a quick reference

Violation	Penalty formula or amount	Statute
Late FC-GPR	INR 7,500 + (0.025% x amount x days delayed); doubles every 12 months	RBI Circular 16/2022-23
SBO / BEN-2 non-filing	INR 50,000 per day	Section 90(10), Companies Act, 2013
Non-filing of FLA Return	INR 7,500 per default	FEMA, 1999
FEMA contravention (general)	Up to 3x amount involved, or INR 2 lakh if amount not quantifiable	Section 13, FEMA, 1999
Non-filing of Form 3CEB	INR 1 lakh minimum	Section 271BA, ITA 1961
TP documentation failure	2% of international transaction value	Section 271AA, ITA 1961
TDS non-deduction	Penalty equal to TDS amount plus interest at 1.5% per month	Section 271C, ITA 1961
Late ROC filings (AOC-4, MGT-7)	INR 100 per day per form (no statutory cap)	Companies Act, 2013
POSH ICC non-constitution	INR 50,000 first offence; INR 1 lakh repeat; criminal liability	Section 26, POSH Act, 2013
DPDPA data breach, failure to notify	Up to INR 200 crores	Section 33, DPDPA, 2023
DPDPA security safeguard failure	Up to INR 250 crores	Section 33, DPDPA, 2023
GST registration failure	Penalties under Section 122, CGST Act, 2017	CGST Act, 2017
DIR-3 KYC non-compliance	DIN deactivation; INR 5,000 to reactivate	Companies Act, 2013

FAQs on Compliance for Foreign Company in India

Q: Does this checklist apply to a branch office or liaison office, or only a WOS?
A: Most obligations above apply to a WOS. A branch office skips SBO/BEN-2 and has a different tax rate, but carries the same FEMA, GST, labour, and data protection obligations. A liaison office has minimal compliance: it cannot generate income, so income tax, GST, and transfer pricing do not apply, but it still requires RBI registration, an Annual Activity Certificate by 30/09 each year, and DPDPA compliance if it processes personal data.

Q: If the parent company is listed on a foreign stock exchange, does SBO still apply?
A: The Companies (Significant Beneficial Owners) Rules, 2018 provide an exemption for companies whose shares are listed on a recognised stock exchange. However, the exemption applies to the parent entity, not to all upstream shareholders. A PE fund that holds a stake in the listed parent through a separately incorporated vehicle does not automatically inherit the listed-entity exemption. Legal analysis is required before assuming the exemption applies.

Q: What is the FOCC classification and when does it become relevant?
A: A Foreign-Owned or Controlled Company is an Indian company owned or controlled by a non-resident, which includes any WOS of a foreign parent. FOCC classification becomes relevant when the Indian subsidiary makes investments in other Indian companies. Those downstream investments are treated as indirect FDI and must comply with the FDI sectoral caps applicable to the investee company’s sector, as if the foreign parent were investing directly. A subsidiary acquiring a stake in an Indian healthcare company, for example, must comply with FDI caps for that sector even though it is an Indian entity making the investment.

Q: When must DPDPA compliance be in place?
A: The Data Protection Board of India was constituted on 13/11/2025. Core compliance duties (consent, breach notification, security safeguards) apply from 13/05/2027. However, building consent architecture, data maps, and processor contracts after that date is substantially more expensive than building them correctly on entry. Companies entering India in 2026 should begin a DPDPA gap assessment before operations start.

Q: Is the compliance obligation list the same for a company in a restricted sector such as defence or insurance?
A: No. Restricted sectors carry additional sectoral licensing obligations (IRDAI registration for insurance, MHA security clearance for defence), additional FDI conditions (minimum capitalisation norms, Indian control requirements), and in some cases a government-route approval requirement before any capital can be invested. The compliance map above covers the baseline. Restricted sector overlays must be assessed against the DPIIT Consolidated FDI Policy and the relevant sectoral regulator’s framework.

Q: How long does it take to complete all Phase 2 through Phase 4 obligations?
A: Incorporation via SPICe+ takes 7 to 15 working days from document submission. Getting documents from the foreign parent (apostilled Certificate of Incorporation, MoA/AoA, board resolutions) takes 3 to 4 weeks. GST registration takes 7 working days. IEC takes 2 to 3 working days. FEMA advance reporting and FC-GPR are time-bound from capital receipt, not from incorporation. Realistically, a fully compliant India entry from decision to operational takes 8 to 12 weeks.

Q: Can the Indian subsidiary start operations before all registrations are complete?
A: No. Operating without GST registration before the registration threshold is crossed is permissible only if turnover is genuinely below INR 20 lakhs and no inter-state supply is made. Starting commercial operations without Shops and Establishments registration, IEC (if importing or exporting), or sector-specific licences is a statutory violation. The safe approach is to complete all Phase 4 registrations before the first commercial transaction.

Regulatory references:

• Foreign Exchange Management Act, 1999 (FEMA), Section 13
• Foreign Exchange Management (Non-Debt Instruments) Rules, 2019
• Foreign Exchange Management (Establishment in India of a Branch Office or a Liaison Office or a Project Office or any Other Place of Business) Regulations, 2016
• RBI Master Direction on Foreign Investment in India (updated January 2025)
• RBI Circular No. 16 (RBI/2022-23/122), dated 30/09/2022 (LSF formula)
• DPIIT Consolidated FDI Policy Circular, F.No. 5(2)/2020, effective 15/10/2020 (as amended, including Press Note 3, March 2026)
• Companies Act, 2013, Sections 90, 96, 99, 123, 139, 149(3), 164(2), 173, 248
• Companies (Significant Beneficial Owners) Rules, 2018
• Companies (Incorporation) Rules, 2014
• Income Tax Act, 1961, Sections 234B, 234C, 234E, 270A, 271AA, 271B, 271BA, 271C, 271G, 271GB, 271GB
• Income Tax Act, 2025, Chapter X (Sections 162 to 177)
• Income Tax Rules, 1962, Rule 10D
• Central Goods and Services Tax Act, 2017, Sections 47, 122
• Integrated Goods and Services Tax Act, 2017
• Employees’ Provident Funds and Miscellaneous Provisions Act, 1952
• Employees’ State Insurance Act, 1948
• Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, Section 26
• Digital Personal Data Protection Act, 2023, Sections 2(i), 33
• Digital Personal Data Protection Rules, 2025 (notified by MeitY, 13/11/2025)
• Finance Act, 2016, Section 165 (Equalisation Levy)