Which filings ensure legal compliance for businesses in India 2026?

Key takeaways

• Compliance means consistent action across taxes, corporate filings, payroll, and data protection, done on time with evidence.
• Build a single calendar for TDS, GST, PF, ESI, ROC, ITR, and DPDP, then reconcile before every filing, not after.
• Watch thresholds and triggers, GST and e-invoicing by turnover, PF and ESI by headcount, DPDP by personal data scale and sensitivity.
• Use a monthly close, bank and gateway recon, GSTR 2B ITC match, TDS challans, and board and AGM timelines for clean books.
• AI Accountant gives a CA led team with a live dashboard, or use this guide as a do it yourself playbook to run compliance like clockwork.

Introduction to legal compliance for businesses

Legal compliance for businesses sounds heavy, yet it is simple in practice, follow the rules for taxes, corporate filings, payroll, and data protection, keep records, and meet due dates. In India, there are many moving parts, Income Tax, TDS, GST, ROC, PF, ESI, and the DPDP Act for data privacy. Dates change, thresholds shift, and forms differ by entity type.

This guide turns the noise into a practical system, what to do, when to do it, common traps to avoid, and a calendar you can actually use. AI Accountant can help when you want a CA led team and a dashboard that shows status in real time, still, this remains a complete do it yourself playbook.

Rule of three, file on time, reconcile first, document everything.

Source links: Global People Strategist, Mysa statutory compliance

Why legal compliance for businesses matters

Non compliance is costly and disruptive. A few real world examples help.

• GST non registration when needed means operating outside the law, loss of input tax credit, and penalties with interest.
• PF or ESI violations can lead to fines and in serious cases, prosecution.
• The DPDP Act is strict on personal data, fines can go up to INR 250 crore for severe lapses.

Compliance protects continuity, keeps GST active, directors safe, and investor due diligence clean, it also strengthens your brand because timely filings build credibility.

Always check the latest notifications on official portals, thresholds and due dates can change.

Source links: Global People Strategist, Mysa statutory compliance, DPDP checklist

Key regulators and business forms

• MCA and ROC under the Companies Act 2013, registration and annual filings like AOC 4 and MGT 7.
• Income Tax Department, ITR, TDS, and advance tax.
• GSTN, registration, returns, e invoice, and e way bills.
• EPFO and ESIC, PF and ESI.
• State Shops and Establishments, working hours and wage rules.
• FSSAI for food businesses.
• DPIIT Udyam for MSME registration and benefits.
• DPDP Act 2023, personal data obligations.

Business forms and what they imply

• Proprietorship, simple start, no limited liability, use PAN, TAN, and GST if needed, check state Professional Tax.
• Partnership, LLP, Private Limited, OPC, limited liability in different forms, with ROC filings and governance, most companies register via MCA SPICe plus.

Pick your form based on risk, funding, and compliance comfort, private companies have more filings yet build investor trust.

Source links: Global People Strategist, DPDP checklist, Ahlawat Associates

Incorporation and foundational registrations

• Name approval and SPICe plus incorporation on MCA for company, OPC, or LLP.
• Obtain PAN and TAN.
• Open a current account with full KYC, match legal name and address with proof.
• Register under local Shops and Establishments Act as applicable.
• Consider Udyam MSME for scheme benefits.
• Sector permits, FSSAI for food, IEC for import export, pollution control consents where needed.

Tip, keep digital copies of all registration documents in a shared folder with clear names.

Source links: Global People Strategist, Mysa statutory compliance, Ahlawat Associates

Direct tax compliance, income tax and TDS

Core TDS rules and flow

• Deduct TDS on eligible payments, for example section 194C for contracts, section 194J for professional fees, check rates and PAN status.
• Deposit TDS by the seventh of the next month.
• File quarterly TDS returns, Form 24Q for salaries, Form 26Q for domestic non salary, Form 27Q for non residents, due dates, July 31 for Q1, October 31 for Q2, January 31 for Q3, May 31 for Q4.
• Issue TDS certificates on time, Form 16 and Form 16A.

Advance tax and ITR

• Advance tax in four parts, June 15, September 15, December 15, March 15.
• File ITR, usually July 31 for non audit cases, later for audit cases, confirm current tax audit thresholds.
• For foreign remittances, prepare Form 15CA and 15CB as needed.

Create a TDS master by section and rate, automate challans, reconcile Form 26AS, AIS, and vendor books before year end.

Source links: Global People Strategist, Mysa statutory compliance

Indirect tax compliance, GST

Registration and thresholds

• Register when sales cross the threshold, as a guide greater than INR 40 lakh for goods and greater than INR 20 lakh for services, inter state sales and e commerce can trigger earlier.
• Consider composition for small taxpayers, for exports consider LUT for zero rated supplies.

Returns and e compliance

• File GSTR 1 and GSTR 3B monthly or under QRMP if eligible.
• File annual return GSTR 9 by December 31 after year end.
• E invoicing is mandatory above turnover thresholds, often INR 5 crore, confirm the latest rule for your year and sector.
• Generate e way bills for goods movement above limits.
• Apply reverse charge where due, for example import of services and notified supplies.
• Reconcile ITC with GSTR 2B monthly to avoid mismatch and interest, see GST reconciliation guide.

Use correct HSN, place of supply, and RCM logic, and map GST returns to books every month.

Source links: Global People Strategist, Mysa statutory compliance

Corporate law and ROC compliance for companies and LLP

For companies

• DIR 3 KYC for directors by September 30.
• Hold board meetings and the AGM within prescribed timelines.
• File AOC 4 within 30 days of AGM, see ROC and secretarial support guide.
• File MGT 7 within 60 days of AGM.
• Report event based changes, director changes, share allotments, office shifts, within due dates.

For LLP

• File Form 8 and Form 11 within prescribed dates.
• Keep LLP agreement and partner details updated.

Source links: Ahlawat Associates, Global People Strategist

Payroll and labour compliance, PF, ESI and more

• PF applies when you have more than 20 employees, deposit by the fifteenth, file on EPFO portal.
• ESI applies when you have more than 10 employees in covered areas, deposit by the fifteenth, file on ESIC portal.
• Professional Tax is state specific, follow state schedule.
• Shops and Establishments govern working hours, holidays, wages, state specific.
• Bonus, Gratuity, and Maternity rules apply by headcount and conditions, maintain policies and records.
• POSH requires an Internal Committee, training, and often an annual report.

Run payroll with clean HR data, link salary TDS with Form 24Q, and keep tax friendly, compliant salary structures.

Source links: Global People Strategist, Mysa statutory compliance, Ahlawat Associates

Accounting, audit and records compliance

• Maintain proper books, under the Companies Act keep records at least 8 years, under GST and Income Tax usually 6 to 8 years, preserve vouchers and invoices.
• Plan audits, statutory for companies and entities above thresholds, tax audits under Income Tax by turnover, confirm current limits each year.
• Reconcile often, banks, vendors, customers, payment gateways, fixed assets, inventory.
• Close the year with clean ledgers, post provisions, prepare schedules, tie out TDS and GST balances.

A monthly close checklist reduces year end pressure and prevents compounding errors.

Source links: Global People Strategist, Mysa statutory compliance

Data protection and IT compliance under DPDP Act 2023

• Provide clear notices and take consent where required, honor rights for access, correction, and erasure.
• Define roles, Data Fiduciary and Data Processor, map vendors and processing activities.
• Report data breaches as required, maintain an incident response process.
• If you are a Significant Data Fiduciary, conduct DPIAs and appoint an India based DPO.
• Align with CERT In advisories and the Information Technology Act.

Start with a data inventory, limit access, encrypt where sensible, train teams, and delete what you no longer need.

Source links: DPDP checklist, Global People Strategist

Compliance calendar for businesses, monthly, quarterly, annual

Monthly cadence

• TDS deposit by the seventh.
• PF deposit by the fifteenth.
• ESI deposit by the fifteenth.
• Professional Tax per state schedule.
• GST, GSTR 1 and GSTR 3B as per scheme.

Quarterly cadence

• TDS returns, 24Q, 26Q, 27Q, due on July 31, October 31, January 31, May 31 for Q4.
• Advance tax, June 15, September 15, December 15, March 15.

Annual cadence

• ITR by July 31 for most non audit cases unless extended.
• GST annual return, GSTR 9 by December 31 after year end.
• ROC, AOC 4 within 30 days of AGM, MGT 7 within 60 days, DIR 3 KYC by September 30.

Event based cadence

• Director changes, share allotments, registered office shifts, file with ROC within due dates.
• GST registration or amendment triggers, place of business or activity changes.
• Payroll headcount crossing PF or ESI thresholds.

Source links: Global People Strategist, Mysa statutory compliance, Ahlawat Associates

Thresholds by business stage and size

Freelancers or sole proprietors under INR 20 lakh to 40 lakh

• GST may be optional if no inter state or e commerce triggers.
• ITR is basic, presumptive tax may fit.
• Check state Professional Tax.

SMEs and startups around INR 40 lakh to 5 crore

• GST becomes standard, consider QRMP if eligible.
• Payroll sets in, PF and ESI may apply as headcount rises.
• Companies must track ROC basics, watch e invoicing thresholds.

Growth stage above INR 5 crore

• E invoicing very likely mandatory, confirm current cutoff.
• Audits apply, tax audit and possibly internal audit.
• Heavier personal data processing may require DPIAs and stronger governance under DPDP.

Plan for the next threshold when you are at 70 to 80 percent of it.

Source links: Mysa statutory compliance, Global People Strategist, DPDP checklist

Common pitfalls in legal compliance and how to avoid them

• Late GST or PF registration, set a trigger during first client or employee onboarding.
• TDS misclassification, keep a simple TDS cheat sheet by section, review contracts before the first payment.
• ITC not matched with GSTR 2B, reconcile monthly and nudge vendors to file on time.
• Missed DIR 3 KYC, schedule a recurring task and buffer by September 15.
• Poor data mapping under DPDP, maintain a data inventory and refresh quarterly.

Thirty minutes of monthly review prevents months of interest and late fees.

Source links: Mysa statutory compliance, DPDP checklist, Ahlawat Associates

Operationalize compliance with checklists, dashboards and SOPs

• Create a RACI matrix, who is Responsible, Accountable, Consulted, Informed.
• Build a central calendar with monthly, quarterly, annual, and event based tasks.
• Write short SOPs for TDS, GST, payroll, ROC, and DPDP.
• Run a monthly close checklist, bank and gateway recon, AR and AP aging, GSTR 2B ITC check, TDS challans and return status.
• Use a dashboard for alerts, reminders, and evidence tracking, challans, returns, acknowledgements.

Helpful tools for accounting and compliance tracking

• AI Accountant
• QuickBooks Online
• Xero
• Zoho Books
• TallyPrime
• FreshBooks

AI Accountant offers a CA led service with a live dashboard, so you get visibility and no missed due dates.

AI Accountant Virtual Accounting for legal compliance

AI Accountant Virtual Accounting is a CA led managed service and dashboard in one place. The team handles bookkeeping, GST, TDS, ITR, payroll support, ROC annual filings for small companies, and routine reconciliations. The dashboard shows live financials, a compliance calendar, AI insights, bank analysis, a document vault, and a single chat lane with your CA team.

You can also download free templates and check official forms here:

• GSTN for GST registration and returns
• Income Tax portal for ITR and TDS
• MCA portal for ROC filings
• EPFO for PF

Source links: GSTN, Income Tax portal, MCA, EPFO

Important notes and last mile tips

• Verify the latest rules on official portals, laws and due dates can shift.
• Keep DIN, PAN, TAN, GST, CIN, and bank details consistent across documents.
• Use simple file names, for example SupplierName Month Year TDS Challan.
• Reconcile first, then file, never the other way round.
• Train teams to spot triggers, a new state, an export client, or a headcount jump.

Master checklist for legal compliance for businesses

Incorporation and IDs

• Company or LLP through SPICe plus if you need limited liability
• PAN and TAN issued and active
• Bank account opened and mapped to PAN
• Shops and Establishments registration as per state
• Udyam MSME if useful
• Sector permits, FSSAI, IEC, pollution board where needed

Direct tax and TDS

• TDS sections mapped for each vendor and employee
• Monthly TDS deposit by the seventh
• Quarterly TDS returns filed on time
• Form 16 and 16A issued
• Advance tax paid on four dates
• ITR filed and tax audit checked

GST

• Registration done if threshold or trigger met
• HSN and place of supply logic in invoicing
• GSTR 1 and GSTR 3B filed as per cycle
• Annual GSTR 9 filed
• E invoicing live if turnover meets rule
• E way bills mapped for logistics
• ITC matched with GSTR 2B monthly

Corporate law

• DIR 3 KYC for all directors by September 30
• AGM held within time
• AOC 4 and MGT 7 filed post AGM
• Event based filings on time
• LLP Form 8 and 11 if LLP

Payroll and labour

• PF and ESI registration when headcount triggers
• PF and ESI paid by the fifteenth each month
• Professional Tax registered and paid per state
• Salary TDS aligned with 24Q
• POSH Committee set and trained

Books and audits

• Books maintained and backed up
• Bank, AR, AP, and inventory reconciled monthly
• Fixed asset register updated
• Year end close with schedules
• Audit planned and completed if applicable

Data protection

• Privacy notice and consent model in place
• Data inventory with processors and vendors
• Breach response plan ready
• DPO and DPIA if Significant Data Fiduciary

Source links: Global People Strategist, Mysa statutory compliance, Ahlawat Associates, DPDP checklist

Call to action

Want a quick health check, book a free 30 minute compliance review and a short dashboard demo, see how AI Accountant Virtual Accounting brings a CA led service with a live compliance calendar, AI insights, and tidy records. If you prefer do it yourself, keep this guide handy and use official portals for the latest forms and dates.

Disclaimer

Updated for FY 2025 26. This is practical guidance, not legal advice. Confirm details with your CA and official portals for your facts and year.

FAQ

As a founder, what is the fastest way to get from incorporation to a working compliance stack without missing any early stage filings

Follow a three week sprint, week one, finish SPICe plus, PAN, TAN, bank account, Shops and Establishments, and Udyam if applicable. Week two, GST registration if triggered, payroll setup with PF and ESI evaluation, basic accounting software and a monthly close checklist. Week three, build a compliance calendar, TDS, GST, PF, ESI, ROC, ITR, and a data inventory for DPDP. AI Accountant can compress this into a guided onboarding with templates, reconciliations, and due date alerts.

For a finance head, how do I assure the board that filings are complete and reconciled, not just submitted

Insist on a filing pack for every due date, challan, return acknowledgment, ledger extract, and reconciliation tie out. For GST, include GSTR 1 to books, GSTR 3B to books, and ITC to GSTR 2B. For TDS, match challans to the OLTAS view and Form 26AS. AI Accountant provides a dashboard view with green or amber status, plus a downloadable filing pack per period.

Do virtual accounting providers take liability for penalties if they miss a due date, how do SLAs work in practice

Most providers operate on effort based SLAs, not indemnity SLAs. A solid SLA defines scope, data cutoff dates, due date calendars, escalation paths, and rework timelines. AI Accountant uses clear cutoffs, for example TDS data lock by the fifth, GST data lock by the tenth, with auto escalations for pending items, and a full audit trail of approvals.

How does an AI enabled service like AI Accountant improve GST ITC accuracy across multi state registrations and multiple ERPs

AI Accountant ingests sales and purchase data, normalizes vendor GSTINs, flags HSN and place of supply gaps, and matches 2B credits to vendor wise ledgers. It then generates variance buckets, timing, vendor non filing, ineligible credit, and communicates vendor nudges. For multi state GST, it segments returns by GSTIN with cross checks for stock transfers and e way bills.

What is the onboarding timeline if I migrate mid year, and how is opening balance integrity ensured

Typical timeline is two to four weeks, week one, data room setup, bank and payment gateway statements, prior returns and trial balances. Week two, ledger mapping, vendor and customer clean up, TDS section mapping, GST HSN and RCM mapping. Week three, opening balance verification, bank and GST to books tie outs, first monthly close under the new process. AI Accountant produces a signed opening balance memo with variances listed and resolved.

How are DPDP obligations handled by a virtual accounting partner, especially for payroll and vendor KYC data

Ask for a data inventory, purpose of use, retention timelines, access controls, encryption at rest and in transit, and breach response. Payroll and KYC data should be ring fenced with role based access and strict retention. AI Accountant operates with a documented DPDP playbook, maintains a processor register, supports Data Subject Requests, and can appoint a DPO for Significant Data Fiduciary clients as required.

Can a CA managed virtual team handle assessments, notices, and departmental queries, or do I still need a local firm

Routine notices and reconciliations can be handled online by a virtual CA team, including GST mismatch responses, TDS demand reconciliations, and ROC resubmissions. For hearings that require physical presence, a local associate is engaged. AI Accountant coordinates end to end, prepares working papers, and briefs counsel where in person attendance is needed.

What does a robust monthly close look like for an SME with two bank accounts, a payment gateway, and e invoicing

Day one to three, bank and gateway reconciliations, accruals, and revenue cutoffs. Day four to six, GST 2B match, TDS challans, and payroll journals. Day seven to eight, management pack, P and L, balance sheet, cash flow, aging, and variance analysis, then lock the period post filings. AI Accountant automates reconciliations, surfaces exceptions, and locks prior periods after returns are filed.

How do pricing models usually work, fixed fee versus time and material, and what drives ROI

SMEs usually prefer a fixed monthly fee that scales by transaction volume, number of GSTINs, payroll headcount, and reporting complexity. ROI is realized from avoided penalties, faster closes, better cash visibility, and reduced internal bandwidth spent on compliance. AI Accountant publishes transparent tiers and adjusts quarterly based on volume and scope changes.

Can AI Accountant integrate with my existing stack, Tally, Zoho Books, QuickBooks, banking, payroll, and document storage

Yes, the service connects through exports and APIs where available, Tally via connectors or scheduled exports, cloud systems via APIs, and banking via statements or feeds. Payroll systems provide Form 24Q ready exports, and documents flow into a shared repository. The goal is light change management with strong controls.

For a CA office evaluating a tech partner, what evidence should I seek to trust the platform and process

Look for SOC reports where applicable, detailed SOPs, maker checker workflows, time stamped audit trails, and recovery objectives. Review live samples of filing packs, reconciliation reports, and notice response kits. AI Accountant provides sandbox access, redacted case studies, and a governance roadmap aligned with DPDP and CERT In advisories.

How are escalations handled when a due date is at risk, and what visibility do founders get

Good practice is a three level escalation, preparer to reviewer to CA lead, with automated alerts three, two, and one day before the cutoff. Founders should see a red amber green dashboard across TDS, GST, PF, ESI, ROC, and ITR, plus a list of documents pending from the business side. AI Accountant implements this cadence and logs every nudge and approval.

What happens if thresholds change mid year, e invoicing kicks in, or PF coverage expands to a new location

Your calendar and SOPs must be updated the same week, including invoice templates, IRN generation, and workflow changes for approvals. For PF expansion, register the new code, enroll employees, and back pay if required. AI Accountant tracks regulatory updates and rolls out controlled SOP changes with checklists and test runs before go live.

Can virtual accounting support investor diligence and audit readiness without me building a large in house team

Yes, with monthly reconciliations, filing packs, working papers, and a document index, investors and auditors get what they need on day one. AI Accountant provides a diligence bundle, corporate documents, statutory registers, financial statements, trial balances, ledgers, tax returns, challans, and bank confirmations, reducing diligence friction.