Compliance
under Indian law.
Indian statutory compliance is 49 live recurring obligations across nine regulators — GST, income-tax, MCA/ROC, LLP, EPF/ESI, labour, RBI, FEMA and SEBI — each with its own citation, applicability test and penalty ladder. The dates are statutory and do not shift for Sundays; regulators extend only by ad-hoc notification. This hub maps the governing provisions to the calendar, the ROC forms and the DPDP readiness assessment.
Last reviewed: 19 August 2026 · every citation on this page names the dataset it came from
- 10governing provisions
- 12product capabilities
- 5free tools
- 1free templates
- 50compliance deadlines
- 5audiences
Compliance in India is not one calendar but nine, stacked. GST alone runs GSTR-1 under s.37(1) of the CGST Act, 2017 with Rule 59(1), GSTR-3B under s.39(1) with Rule 61(1), the annual GSTR-9 under s.44 with Rule 80(1), and the GSTR-9C reconciliation under Rule 80(3) — plus CMP-08 and GSTR-4 for composition dealers, GSTR-7 for TDS deductors under s.51, GSTR-8 for e-commerce TCS under s.52, and ITC-04 for job work under s.143.
Income-tax adds monthly TDS/TCS deposit under s.397 of the Income-tax Act, 2025 with Rule 218 of the Income-tax Rules 2026, four quarterly statements under s.397(3)(b), four advance-tax instalments under s.408, the return under s.263(1), the tax-audit report under s.63, and the transfer-pricing report under s.172. MCA adds AGM, AOC-4, MGT-7/7A, ADT-1, DPT-3, MSME-1 and DIR-3 KYC; LLPs add Forms 11 and 8. EPF/ESI, labour, RBI's ECB-2, FEMA's FLA and ODI APR, and SEBI LODR quarterly and annual filings complete the set.
Privacy is the newest layer and the one most organisations have mis-dated. The DPDP Act, 2023 commenced in phases under G.S.R. 843(E): 13 November 2025 stood up the Data Protection Board only, 13 November 2026 opens Consent Manager registration under s.6(9) and nothing else, and 13 May 2027 brings the entire operative regime — ss.3-5, s.6(1)-(8) and (10), ss.7-17, and the penalty machinery in ss.28-34 with the Schedule. The readiness quiz groups every gap it finds against those dates.
The provisions, with their section numbers.
Each row names the dataset it was taken from — the seeded statute library, the compliance calendar's own statutory reference, the bare Limitation Act, or the DPDP research set. Nothing here was written from memory.
Tools that apply to this work.
Each runs in your browser. Nothing is uploaded anywhere, and none of them needs an account.
Every recurring statutory due date, month by month, each carrying its own citation.
The nine MCA/ROC filings a company or LLP must diarise, with the due rule and late-fee ladder.
15-question weighted self-assessment against the DPDP Act 2023 and the DPDP Rules 2025.
Interest under 234A/234B/234C, CGST s.50, TDS 201(1A) and the 234E fee, each with its citation.
Validate a GSTIN's checksum and decode state code, PAN and entity type — runs in your browser.
Free templates for this area.
Free to copy, modify and use commercially, without attribution. They are starting points, not advice — have a qualified advocate or company secretary review anything before you sign it.
The capabilities that do this work.
Every one of these is a real feature page with its own status — Live, Beta or Soon. If it says Beta, it is in beta.
Every deadline that applies to your entity in one calendar, with advance alerts.
SEBI, RBI, MCA/ROC, and GST circulars + filings tracked end-to-end.
New circulars summarised and filterable by Act, regulator, and effective date.
Self-serve gap analysis against DPDP Act §6 + §13 with a remediation plan.
Vendor-onboarding review, weekly compliance scan, GST reconciliation — ready to enable.
Build your own multi-step agent with triggers, conditions, and actions. No code.
Cron-style scheduling — daily, weekly, or on the GST due-date.
Human-in-the-loop gates between agent steps.
Outgoing webhooks on key events — scan-complete, alert-fired, deadline-hit.
A searchable record of state-changing actions across the workspace.
GST math, ITC reconciliation against GSTR-2B, and e-invoicing validation.
Auto-flags TDS obligations from contract clauses — section, rate, threshold, due date.
The modules this area draws on.
The people who do compliance work.
AI for the contracts your clients keep sending you.
Legal protection without the legal fees.
Custom AI. Unlimited seats. Your data, your cloud.
AI-native SEBI, RBI and AMFI compliance.
Deliver more client work with white-label AI.
50 compliance deadlines touch this area.
These are the statutory dates, not the extended ones — there is no automatic carry-forward when a due date falls on a Sunday or a gazetted holiday, and regulators grant relief only by ad-hoc notification. Every row states who it applies to; almost none of them applies to every entity.
- GSTR-1 — Outward supplies
- GSTR-3B — Summary return
- CMP-08 — Composition quarterly statement
- GSTR-4 — Composition annual return
- GSTR-9 — Annual return
- GSTR-9C — Reconciliation statement
- GSTR-7 — TDS return (deductor)
- GSTR-8 — TCS return (e-commerce)
- ITC-04 — Job-work declaration (Apr-Sep)
- ITC-04 — Job-work declaration (Oct-Mar)
- TDS / TCS payment
- TDS / TCS — Q1 statement
- TDS / TCS — Q2 statement
- TDS / TCS — Q3 statement
- TDS / TCS — Q4 statement
- Advance Tax — Q1 (15%)
- Advance Tax — Q2 (45%)
- Advance Tax — Q3 (75%)
- Advance Tax — Q4 (100%)
- ITR filing — Individuals / HUFs (no audit)
- Tax audit report (ex-3CA/3CB + 3CD)
- ITR filing — Companies / audit cases
- Transfer pricing accountant's report (ex-3CEB)
- ITR filing — TP cases
- Belated / revised return
- AGM — Annual General Meeting
- AOC-4 — Financial statements filing
- MGT-7 / MGT-7A — Annual return
- DIR-3 KYC — Director KYC (now triennial)
- DPT-3 — Return of deposits
- MSME-1 — H1 (Apr-Sep) outstanding
- MSME-1 — H2 (Oct-Mar) outstanding
- ADT-1 — Auditor appointment
- LLP Form 11 — Annual return
- LLP Form 8 — Statement of account & solvency
- EPF — Monthly contribution + ECR
- ESI — Monthly contribution
- ESI — Half-yearly return of contributions (Apr-Sep)
- ESI — Half-yearly return of contributions (Oct-Mar)
- POSH — Annual Report to District Officer
- Statutory bonus — Annual disbursal
- Annual return — contract labour / establishment (ex-CLRA Form XXV)
- ECB-2 — Monthly ECB return
- FLA — Foreign Liabilities & Assets return
- APR — Annual Performance Report (ODI)
- SEBI LODR — Quarterly filings (Q4, Jan-Mar)
- SEBI LODR — Quarterly filings (Q1, Apr-Jun)
- SEBI LODR — Quarterly filings (Q2, Jul-Sep)
- SEBI LODR — Quarterly filings (Q3, Oct-Dec)
- SEBI LODR — Annual audited financial results (Reg 33)
Compliance — the questions people actually ask.
How many statutory deadlines does an Indian company actually have?
The compliance calendar carries 49 live recurring obligations across nine regulators, but almost none of them apply to every entity — each row states who it applies to. A private company with no listing, no ECB, no FDI, no composition scheme and fewer than 20 employees will match a small fraction of them. The applicability line is the part to read first.
When does the DPDP Act actually start biting?
13 May 2027 for substantive compliance and enforcement. The commencement notification G.S.R. 843(E) split the Act into three phases: 13 November 2025 brought only the Data Protection Board provisions into force — the institution, not the jurisdiction, and s.27's complaint power was not among them. 13 November 2026 brings only s.6(9) and s.27(1)(d), which concern Consent Manager registration. Everything else — notice, consent, security safeguards, breach intimation, children's data, Data Principal rights, cross-border, and the penalty Schedule — commences at eighteen months, on 13 May 2027.
Do the calendar's dates account for extensions?
No, and that is deliberate. The dates encoded are the statutory dates. Regulators extend ad hoc by notification — Notification 01/2026-Central Tax moved the March-2026 GSTR-3B from 20 to 21 April 2026, and CBDT moved the AY 2025-26 tax-audit specified date from 30 September to 31 October 2025 — and encoding those retroactively would make the calendar unreliable in the other direction. Track extension notifications separately; use the calendar for the date to work backwards from.
What can LexVio automate here rather than just track?
Pre-built agents cover vendor-onboarding review, a weekly compliance scan and GST reconciliation. Custom agents let you build a multi-step workflow with triggers, conditions and actions without code, and approval workflows put a human gate between agent steps. Scheduled runs are cron-style — daily, weekly, or on the GST due date — and webhooks fire outward on scan-complete, alert-fired and deadline-hit.
A map of the material, not advice on your matter. These hubs point at statutory text, free calculators and product capabilities. They are not legal advice, they do not create an advocate-client relationship, and they are no substitute for reading the bare Act as currently amended. Indian law is fact- and state-specific — stamp duty, registration and several employment obligations vary by state, and limitation turns on facts a web page cannot know. Take advice on your own facts before acting.
The law is in the document.
Let LexVio read it first.
Paste any contract. Get a Legal Health Score and the top risks in 30 seconds. No account needed.
Try the free scanner →