# The India Statutory Compliance Layer: IT Act, Labor Law and the 2,000-Filing Problem | AttriEdge

Home / Articles / The India Statutory Compliance Layer: IT Act, Labor Law and the 2,000-Filing Problem Serial H-09 Classification HOW-TO Filed July 18, 2026 Read 1 min read Owner H. Attri The India Statutory Compliance Layer: IT Act, Labor Law and the 2,000-Filing Problem The India statutory compliance layer that runs parallel to US framework attestations, IT Act, labor law, tax compliance and the 2,000-Filing Churn of running an India GCC. By Hemant Attri , Founder, AttriEdge Index Companies Act / MCA filings Income tax and TDS GST Provident Fund and ESI State-specific (professional tax, labor welfare, S&E) Sector-specific overlays Outsourcing landscape Where AttriEdge fits US founders running India GCCs typically learn about India statutory compliance when something breaks, a tax notice, a labor inspection, a blocked filing. Here’s the layer that exists from day one, running parallel to your US framework attestations. SOC 2 doesn’t cover any of it. Companies Act / MCA filings Annual returns, financial statements, director KYC, beneficial-ownership and related-party disclosures, board and shareholder filings, all to the Ministry of Corporate Affairs. Missed MCA filings carry per-day fines and director liability, so a company secretary or CA owns this calendar. Income tax and TDS Corporate tax filings, advance tax and TDS on salaries and contractor payments. Transfer pricing applies to related-party transactions with the US parent, a recurring audit focus for US-HQ-with-India-subsidiary structures. GST Monthly and quarterly returns, state-specific registrations, input-tax-credit management and e-invoicing. GST is high-frequency and unforgiving on deadlines. Provident Fund and ESI Monthly PF contributions and returns, plus ESI for wage-threshold-eligible employees. These are employee-facing, lapses affect staff directly and draw scrutiny. State-specific (professional tax, labor welfare, S&E) Professional tax, labor welfare fund and Shops & Establishments registration are state-specific, each with its own rate and schedule. Operating in three states triples these, the core driver of the 2,000-Filing Churn . Sector-specific overlays RBI (financial services), IRDAI (insurance), SEBI (capital markets), CDSCO (life sciences) layer additional obligations, often including data localization that overrides DPDPA’s general permissibility. Outsourcing landscape Most mid-market GCCs outsource this to payroll/compliance vendors (ADP, Keka, GreytHR, Darwinbox) plus a CA/CS firm, running it through a centralized compliance calendar. How it fits the full program is in the GCC compliance encyclopedia . Where AttriEdge fits We don’t replace your statutory vendor, we make sure the statutory layer is integrated with your security/compliance program so nothing falls between “HR’s problem” and “the auditor’s question.” The diagnostic maps your India statutory coverage alongside your US frameworks. From the register H-10 HOW-TO DPIAs Under India's DPDP Rules: A Template and Walkthrough H-08 HOW-TO Cross-Border Data Flow Diagrams for US-India SaaS Operations H-07 HOW-TO DPDPA Significant Data Fiduciary Requirements: A Practical Compliance Guide H-06 HOW-TO Replacing Screenshots with Automated Evidence Collection: A Migration Guide Chain of custody. Drafted by H. Attri · Filed July 18, 2026 · One specimen of the evidence discipline AttriEdge operates for clients. Frequently asked questions Required vendors for compliance? Most mid-market GCCs use a payroll/compliance vendor (ADP, Keka, GreytHR, Darwinbox, or local firms) for PF, ESI, professional tax, GST and TDS, plus a CA/CS for Companies Act filings. Few staff this in-house at mid-market scale. Penalty exposure for missed filings? Varies by filing, interest and penalties on late PF/ESI/GST/TDS, per-day fines and director liability on Companies Act lapses and inspection risk on labor-law gaps. Individually modest, collectively material across 2,000+ events. Multi-state implications? Each additional state adds professional tax, labor welfare fund, shops-and-establishments and state labor-law obligations, which is what drives the filing count up. Multi-state operations need a centralized compliance calendar. Tools and platforms? Payroll/HR platforms (Keka, GreytHR, Darwinbox), payroll-compliance services (ADP) and a centralized compliance tracker. GRC platforms don't cover this layer, it runs in parallel to SOC 2/DPDPA. Talk to the operator. This document is one slice of the work AttriEdge does for US SaaS companies with India GCCs. If your situation needs the operating layer, start with a 90-minute diagnostic. Book your $999 diagnostic →