Need help with startup legal checklist india? We can handle it for you.
Most founders think legal work starts after traction — once there's a product, a few paying customers, maybe a term sheet on the table. That assumption is backwards. Legal infrastructure isn't something you bolt onto a business once it works. It's part of what makes the business work in the first place.
Here's the simplest way to see it. Product builds value. Customers and revenue prove that value is real. But none of that sits on solid ground unless the layer underneath — the entity, the ownership records, the contracts, the compliance filings — is built correctly from day one. Skip that layer and you're not saving time. You're taking on legal debt.
Legal debt behaves exactly like technical debt. Every shortcut taken early — no founder agreement, no signed employment contracts, GST registration you keep meaning to get to — doesn't disappear. It compounds quietly for months, then comes due at the worst possible moment: a fundraise, an acquisition offer, or a fight between co-founders.
Every major funding round is also a legal due diligence exercise. The product gets you the meeting. The legal infrastructure decides whether the money actually lands.
This guide walks through what legal infrastructure actually means, the six layers every Indian startup needs to build, and the order to build them in — so the work happens on your schedule, not during a due diligence deadline with a term sheet expiry attached to it.
What Is Legal Infrastructure?
Legal infrastructure is the complete set of legal systems, documents, and records a company needs to operate, raise money, and survive scrutiny. It is not the certificate of incorporation framed on the wall. That certificate is one document. Infrastructure is everything that has to stay accurate and current after it's issued.
That's the real difference between paperwork and a system. Paperwork is a document filed once and forgotten — a founder agreement signed in year one and never looked at again while equity splits quietly change in conversation. A system is a document that stays current: a cap table updated every time shares move, a compliance calendar that triggers the next filing automatically, a contract template that gets used for every new hire instead of reinvented each time.
This article is general information, not legal advice. If you need advice for your specific situation, contact BuildWright directly.
Prefer to skip the paperwork?
BuildWright can take this off your plate — done properly, the first time.
Get new templates and compliance updates by email.
Visible
What shows up on a company search or in a pitch deck.
Certificate of incorporation
PAN and TAN
GST registration
Company name and logo
Hidden — until someone asks
What actually gets tested during a fundraise, an audit, or a dispute.
Governance records and board resolutions
IP ownership and assignment
Compliance filings and licences
Signed contracts and employment records
Cap table accuracy
Investors care about the hidden half because it's what due diligence checks. A cap table that doesn't match the share certificates, a co-founder who never signed an IP assignment, a compliance filing that's two years overdue — each of these can stall or kill a round that was otherwise agreed in principle. Founders ignore this layer for an understandable reason: none of it generates revenue. It's insurance, and insurance never feels urgent until the moment it's the only thing that matters.
CB Insights' analysis of startup failure post-mortems found disharmony among the founding team or investors cited as a factor in roughly 7% of failures examined — a smaller share than product-market fit, but one that's almost entirely preventable with a signed founder agreement and a clean cap table. (Source: CB Insights startup failure research, checked July 2026 — a self-reported sample, worth a quick re-check before citing the exact figure in published copy.)
BuildWright Insight: The fastest way to spot legal debt in a startup is to ask for the cap table and the founder agreement on the same call. If either one doesn't exist, or they don't agree with each other, everything downstream — fundraising, hiring, even a clean exit — gets harder.
The Six-Layer Startup Legal Stack
Legal infrastructure builds like a pyramid. Each layer depends on the one below it being solid. Skipping a layer doesn't remove the work — it just means you do it later, under worse conditions, usually with a lawyer on retainer and a deadline attached.
Business Entity — the legal structure the company operates through
Ownership — who owns what, and on what terms
Contracts — the agreements that govern every relationship the company has
Compliance — the filings and registrations that keep the entity legally alive
Governance — the records that prove decisions were made properly
Fundraising Readiness — the state that lets due diligence go smoothly instead of badly
Layers 1 through 4 are foundational — most startups need them within the first year regardless of whether they ever raise outside money. Layers 5 and 6 matter more as the company grows a team and starts talking to investors. The rest of this guide builds each layer in order.
Layer 1: Choosing the Right Business Structure
The entity is the foundation everything else sits on. Getting it wrong doesn't just cost money to fix later — a structure change usually means a fresh incorporation, a new PAN, new contracts, and re-registering GST, all while the business keeps running.
Structure
Best For
Liability
Funding
Compliance
Tax Notes
Proprietorship
Solo founder testing an idea, no outside capital planned
Unlimited — personal assets at risk
Cannot raise equity funding
Minimal — no separate ROC filings
Taxed as individual income
Partnership
Two or more founders, low-risk local business
Unlimited, joint and several
Cannot raise equity funding
Low — registration optional in most states
Taxed as a firm; partners taxed on share
LLP
Services businesses, consultancies, agencies
Limited to capital contribution
Cannot issue equity shares — cannot take VC funding
Moderate — annual ROC filings required
No dividend distribution tax; partners taxed individually
Private Limited Company
Startups planning to raise external funding or issue ESOPs
Limited to shareholding
Can issue equity, preference shares, and ESOPs — the only structure VCs invest in
Corporate tax rates; DPIIT recognition available for tax benefits
One Person Company (OPC)
Solo founder wanting limited liability without co-founders
Limited to shareholding
Cannot bring in additional shareholders without converting to Pvt Ltd
Moderate — similar to Pvt Ltd, lighter board requirements
Taxed as a company
The decision usually comes down to three questions, asked in order. First: are there co-founders, or is this a solo venture? Second: is external funding — angel, VC, or institutional — part of the plan? Third: does the business need limited liability protection from day one, or can that wait? A solo founder with no funding plans can start as an OPC or proprietorship. The moment external equity funding enters the picture, a Private Limited Company is the only structure that works, because it's the only one that can legally issue shares to outside investors.
Choosing an LLP while planning to raise VC funding — LLPs cannot issue equity shares, so this forces a conversion later, mid-fundraise, at the worst possible time.
Incorporating too early — registering a Pvt Ltd before there's a real business, then carrying ROC compliance costs and filings for an idea that hasn't found traction yet.
Incorporating too late — running on a personal bank account and informal agreements for so long that IP ownership, revenue history, and early contracts are never cleanly assigned to the company once it does get incorporated.
BuildWright's Incorporation service — Making it official — handles entity selection, registration, and the first-year compliance setup so this decision gets made once, correctly, instead of revisited under pressure.
Layer 2: Ownership Infrastructure
Ownership infrastructure answers one question precisely: who owns what, and on what terms. It sounds simple until two co-founders remember a verbal 50-50 split differently eighteen months later, with no document to settle it.
Founder agreement — sets equity split, roles, decision rights, and what happens if a founder leaves. Without one, Indian partnership and company law defaults apply, and none of them are written with startups in mind.
Equity split — should reflect contribution, commitment, and risk, not just the original idea. Splits agreed verbally over coffee rarely survive contact with a term sheet.
Vesting — equity earned over time (commonly four years with a one-year cliff), not granted in full on day one. Protects the company if a founder leaves early.
Reverse vesting — the same mechanism applied to shares a founder already holds, so departure triggers a buyback of unvested shares rather than leaving a dead co-founder's full stake untouched.
Deadlock provisions — a pre-agreed process for resolving a 50-50 tie between co-founders, before it happens, not during the argument.
IP assignment — every founder, employee, and contractor formally assigns any IP they create to the company. Without it, the company doesn't legally own its own product.
ESOP planning — an option pool set aside early (commonly 5–15% of the cap table) for future hires, sized before the first funding round so it doesn't dilute founders unexpectedly later.
Cap table hygiene — one accurate, continuously updated record of who owns what, matching the actual share certificates and board resolutions on file.
Three co-founders started a company with an even split and a handshake. One year in, two of them had done most of the work; the third had gone quiet after month three. There was no vesting schedule — so the inactive co-founder still held a full third of the company, with no mechanism to claim it back. The first funding conversation stalled for months while the founders renegotiated equity that should have been settled with a document on day one.
Every item on that list gets dramatically cheaper to fix before money or new hires enter the picture, and dramatically more expensive after. A founder agreement signed in week one costs a conversation. The same agreement negotiated after a falling-out costs a lawyer, months, and sometimes the company.
Layer 3: Contract Infrastructure
A startup accumulates relationships fast — co-founders, employees, contractors, vendors, customers, users. Every one of those relationships needs a contract behind it, or it's running on trust and memory, which don't hold up when something goes wrong.
Document
When Needed
Why
Risk if Missing
NDA
Before sharing anything confidential — pitch decks, product plans, code
Creates a legal basis to act if information leaks
No recourse if a partner or investor shares confidential information
Employment Agreement
Before the first hire joins
Defines role, compensation, IP assignment, and termination terms
Labour disputes default to statutory minimums, often unfavourable to the employer
Contractor Agreement
Before any freelancer or agency starts work
Distinguishes contractors from employees; assigns IP created during the engagement
Contractor may legally own work product; misclassification risk with labour authorities
Service Agreement
Before delivering paid services to a client
Defines scope, payment terms, liability caps, and deliverables
Scope creep and payment disputes with no written terms to fall back on
Vendor Agreement
Before relying on a supplier or platform for critical operations
Sets SLAs, liability, and exit terms if the vendor relationship ends badly
No protection if a vendor fails to deliver or changes terms unilaterally
Privacy Policy
Before collecting any personal data — even just an email signup
Legally required disclosure under the DPDP Act 2023 once it applies to the business
Regulatory exposure and loss of user trust if data practices aren't disclosed
Terms of Service
Before users or customers interact with the product
Sets usage rules, liability limits, and dispute resolution terms
No enforceable limits on liability or misuse of the platform
IP Assignment
At incorporation, and every time a founder, employee, or contractor creates IP
Ensures the company — not an individual — legally owns its product and code
Company may not own its own core product; blocks acquisitions and funding
Shareholders Agreement
Before or at the first external investment
Governs voting rights, transfer restrictions, exit rights, and investor protections
Investors negotiate every protection from scratch, or refuse to close
Mapped to a startup's lifecycle, the pattern is straightforward: NDA and IP assignment come at incorporation. Employment, contractor, and vendor agreements arrive with the first hires and suppliers. Privacy policy and terms of service arrive before the first user signs up — not after. Service agreements arrive with the first paying customer. The shareholders agreement arrives with the first outside cheque. Building each one when it's actually needed, rather than all at once in a panic before a fundraise, keeps the cost and the risk both low.
BuildWright's Documentation service — Put it on paper — covers this entire layer: templates and drafting for every agreement a growing startup needs, built once and reused instead of improvised each time.
Layer 4: Compliance Infrastructure
Compliance is the layer that keeps the entity legally alive. None of it is optional, and almost none of it is a one-time task — it runs on a calendar that starts the day the company is incorporated.
Day 0 — Incorporation
PAN, TAN, and certificate of incorporation issued. Bank account opening and first board resolutions follow immediately.
Day 30 — Statutory registers
Statutory registers (members, directors, charges) opened. GST registration filed if turnover is expected to cross the threshold.
Day 60 — Auditor and books
First statutory auditor appointed (Form ADT-1). Books of account and accounting systems set up.
Day 180 — Commencement of business
Form INC-20A (declaration of commencement of business) due within 180 days of incorporation for companies with share capital — miss it and the company cannot legally start operations or borrow money.
Quarterly
GST returns (if registered), TDS payments and returns, and advance tax instalments where applicable.
Annually
AOC-4 (financial statements) within 30 days of the AGM, MGT-7/MGT-7A (annual return) within 60 days of the AGM, DIR-3 KYC for every director by 30 September, and income tax return filing.
Four categories cover most of what a startup deals with. ROC compliance keeps the company registration current with the Registrar of Companies — annual filings, director KYC, and event-based filings for anything that changes (new directors, share allotments, registered office moves). GST compliance kicks in once turnover crosses ₹40 lakh for goods or ₹20 lakh for services in most states (₹20 lakh and ₹10 lakh respectively in a few special category states) — registration below that threshold is optional but sometimes worth doing voluntarily for input tax credit. Labour compliance covers PF, ESI, and state-level shops and establishments registration once the company starts hiring. Industry licences apply selectively — FSSAI for food businesses, RBI registration for lending or payment products, and sector-specific approvals for anything regulated.
Commencement of business (INC-20A) — once, within 180 days of incorporation
✓✕
Director KYC (DIR-3 KYC) — annually, by 30 September
✓✕
GST registration and returns — monthly/quarterly once turnover crosses the threshold
✓✕
TDS deduction and filing — quarterly, from the first salary or vendor payment above threshold
✓✕
PF/ESI registration — monthly, once employee count crosses the applicable threshold
✓✕
DPIIT Startup India recognition — one-time, unlocks tax and compliance benefits
✕✓
Industry-specific licences (FSSAI, RBI, etc.) — only if the business is in a regulated sector
✕✓
Late ROC filings attract a flat penalty of ₹100 per day per form, with no upper cap. A filing that's a year late on both AOC-4 and MGT-7 can quietly rack up penalties in the lakhs — far more than the cost of filing on time. (Source: Ministry of Corporate Affairs filing rules, checked July 2026.)
Layer 5: Governance
Governance is the record that proves decisions were made properly. Most early-stage founders treat it as paperwork for later — until an investor, auditor, or acquirer asks for board minutes that were never written.
Governance covers board decisions (documented as formal resolutions, not just discussed in a WhatsApp group), statutory registers (members, directors, share transfers), resolutions for anything material — share allotments, new bank signatories, related-party transactions — and the record-keeping discipline that makes an audit or due diligence process fast instead of a scramble.
No records — decisions made verbally, nothing written down
Reactive records — minutes and resolutions drafted only when a bank or investor asks for them
Basic hygiene — resolutions passed for major decisions as they happen, registers kept current
Board discipline — regular board meetings, minuted and filed, even with just co-founders on the board
Audit-ready — every material decision has a paper trail an outside auditor or investor could review with zero notice
Most startups don't need to reach level five before their first funding round. But they do need to be past level two — reactive record-keeping — because due diligence moves at the speed of the slowest missing document, and a missing board resolution for a share allotment is a common one.
Layer 6: Fundraising Readiness
Due diligence is the process where an investor's lawyers verify that everything the company claims about itself is actually true on paper. It's not adversarial by design — it's just thorough, and it moves fast when the paperwork is already organised, and slowly (sometimes fatally for the round) when it isn't.
Incorporation documents — certificate of incorporation, MOA, AOA, and every amendment since
Cap table — matching share certificates, board resolutions, and ROC filings exactly
IP — assignment agreements from every founder, employee, and contractor who touched the product
Compliance — ROC filing history, GST returns, TDS records, and any pending notices
Litigation — disclosure of any past, ongoing, or threatened legal disputes
Licences — every registration and licence the business is required to hold
In practice, this gets organised into a data room — a shared folder (physical checklists have long since moved to tools like DocSend or a secured Google Drive) structured so an investor's diligence team can find everything without asking. A typical structure separates corporate documents, financials, cap table and securities, material contracts, IP, compliance and litigation, and HR — each as its own folder, kept current, not assembled the week the term sheet arrives.
Where AI Helps, and Where Humans Still Matter
AI tools are genuinely useful for legal work now — but only for a specific slice of it. Knowing which slice is what keeps founders from either over-relying on AI drafts or paying a lawyer to do work a tool could handle in minutes.
Handles it well
Needs a human
First drafts of standard agreements (NDA, employment offer)
✓✕
Summarising long contracts or compliance requirements
✓✕
Generating checklists and compliance calendars
✓✕
Allocating risk in a negotiated clause
✕✓
Negotiating terms with an investor or acquirer
✕✓
Interpreting how a new regulation applies to a specific business
✕✓
Deciding overall legal and equity strategy
✕✓
The pattern holds across every layer in this guide: AI is excellent at producing a first version fast and cheap. It is not a substitute for a person who understands what a specific clause is actually protecting against, or how a regulator is likely to read a specific fact pattern. Use AI to move faster on the first 80%. Use a lawyer for the last 20%, where the actual risk lives.
Three Founder Journeys
The six layers apply to every startup, but the order and urgency shift by business model. Here's how the infrastructure typically evolves across three common founder paths — from idea to a funded, hiring company.
SaaS Startup
IP is the entire asset, so ownership and contract infrastructure come first.
Idea: Founder agreement and IP assignment signed before a line of code is committed.
MVP: Terms of service and privacy policy live before the first signup — SaaS collects data from day one.
Revenue: Service/subscription agreements templated for every customer tier.
Hiring: Employment and contractor agreements for the first engineers; ESOP pool carved out.
Funding: Cap table and IP assignment chain are the two documents diligence checks hardest.
D2C Brand
Compliance and vendor contracts dominate early, because physical goods mean regulators and supply chains from day one.
Idea: Entity choice and trademark search before the brand name is locked in publicly.
MVP: FSSAI or relevant product licensing, GST registration for interstate sale of goods.
Revenue: Vendor and manufacturing agreements; consumer protection-compliant terms of service.
Hiring: Warehouse and logistics staff bring labour compliance (PF/ESI) in earlier than most SaaS peers.
Funding: Inventory and vendor contract hygiene get scrutinised alongside the usual cap table checks.
Fintech
Regulatory licensing is the binding constraint — nothing else matters if the licence isn't right.
Idea: Entity structure and RBI/regulatory pathway mapped before building — some models need a licence before launch, not after.
MVP: Privacy policy and data handling infrastructure are non-negotiable given the sensitivity of financial data.
Revenue: Partnership agreements with banks or NBFCs, drafted to survive regulatory scrutiny, not just commercial negotiation.
Hiring: Compliance officer role often required by the regulator, not just good practice.
Funding: Regulatory standing is diligenced as hard as the cap table — a licensing gap can kill a round outright.
The Founder's Legal Toolkit
Five checklists cover most of what's in this guide in a form that's actually usable day to day, rather than read once and forgotten.
Startup Legal Checklist — the full six-layer stack condensed into a single sequential to-do list
Due Diligence Checklist — everything an investor's lawyers will ask for, organised by data room folder
Founder Agreement Checklist — every clause a founder agreement needs, including vesting and deadlock
Compliance Calendar — every recurring filing deadline, mapped to the company's incorporation date
Entity Decision Matrix — the structure decision from Layer 1, reduced to three questions
Frequently Asked Questions
Do I need a company before I get customers?
No — you can validate an idea and even take early payments as a proprietorship or informally. But the moment there's real revenue, co-founders, or a plan to raise money, incorporate before signing customer or vendor contracts, so the company — not an individual — owns the relationships and the IP.
When should I register for GST?
Registration becomes mandatory once turnover crosses ₹40 lakh for goods or ₹20 lakh for services in most states (lower thresholds apply in a few special category states). Many startups register earlier anyway, voluntarily, to claim input tax credit and look more credible to B2B customers who expect a GSTIN on the invoice.
Can I use AI to draft legal agreements?
Yes, for a first draft of standard documents like NDAs or offer letters. No, for anything with negotiated risk allocation — a shareholders agreement, a licensing deal, or a contract with liability exposure. Use AI to save time on the 80% that's boilerplate; get a lawyer to review the 20% that isn't.
What happens if we don't sign a founder agreement?
Default rules under Indian partnership and company law apply instead — and none of them are written with startup equity, vesting, or IP assignment in mind. In practice this means equity splits, IP ownership, and exit terms are all open to dispute exactly when a dispute is most likely: when a co-founder leaves or a company gets valuable.
Can an LLP raise venture capital?
Not directly. LLPs cannot issue equity shares, and VC funds generally invest through equity or convertible instruments that only a company structure can issue. A startup that expects to raise institutional funding should incorporate as a Private Limited Company from the start, or convert before the first funding conversation — converting mid-negotiation adds delay and cost.
Which company structure is best for a startup?
For most startups planning to raise external funding, hire a team, or issue ESOPs, a Private Limited Company is the right structure — it's the only one that can issue equity shares to investors and stock options to employees. Solo founders with no funding plans can start simpler, as an OPC or proprietorship.
What compliance is mandatory for a Private Limited company?
At minimum: commencement of business declaration (INC-20A) within 180 days of incorporation, annual financial statement filing (AOC-4) and annual return (MGT-7) after every AGM, director KYC (DIR-3 KYC) every year, and income tax returns. GST, TDS, and labour compliance apply once the relevant thresholds are crossed.
What is DPIIT recognition and does my startup need it?
DPIIT (Startup India) recognition is a government status for companies, LLPs, and a few other entity types under 10 years old (20 for Deep Tech) with turnover under ₹200 crore (₹300 crore for Deep Tech) in any financial year, working toward genuine innovation. It's not mandatory, but it unlocks real benefits — tax exemptions, easier compliance under certain labour laws, and credibility with investors who screen for it.
Is angel tax still a problem in India?
No — Section 56(2)(viib), the provision behind angel tax, was removed from the Income Tax Act by the Finance Act 2024, effective for funding raised from 1 April 2025 onward. Startups can now issue shares at any valuation premium without angel tax exposure on that raise. Funding raised before that date can still face legacy angel tax scrutiny for the relevant assessment years.
What is reverse vesting and why does it matter?
Reverse vesting applies a vesting schedule to shares a founder already holds, so if they leave early, the company (or the remaining founders) can buy back the unvested portion at a nominal price. Without it, a founder who leaves after three months keeps their full original stake forever — exactly the scenario that stalls funding rounds.
Do I need a privacy policy if I don't have an app yet?
If you collect any personal data — even just an email address on a landing page — you need one. The DPDP Act 2023 and its 2025 rules apply broadly to any digital personal data processed in India, and the compliance obligations are being phased in through 2026 and into mid-2027. Building a compliant privacy policy early is far cheaper than retrofitting one after a data request or complaint.
What's the difference between an NDA and an IP assignment agreement?
An NDA stops someone from sharing confidential information. An IP assignment transfers ownership of anything they create — code, designs, content — to the company. A contractor can sign an NDA and still legally own the code they wrote for you if there's no separate IP assignment clause or agreement.
How much should the ESOP pool be?
Most early-stage Indian startups set aside somewhere between 5% and 15% of the cap table for an option pool, sized based on planned senior hires over the next 12–18 months. Carve it out before the first funding round — investors often ask for the pool to be created (or topped up) out of founder equity as a condition of the deal, so it's cheaper to size it correctly upfront.
What happens if I miss ROC filing deadlines?
A flat penalty of ₹100 per day per form applies, with no upper cap — so a filing that's months or years late can accumulate a penalty far larger than the original compliance cost would have been. Repeated non-compliance can also affect director eligibility and company status with the Registrar.
When do I need a shareholders' agreement?
The moment an outside investor puts money into the company — even a small angel cheque. The shareholders' agreement governs voting rights, transfer restrictions, information rights, and exit terms between founders and investors, and it's far easier to negotiate once, cleanly, than to patch together after multiple rounds with inconsistent terms.
What's a data room and when do I need one?
A data room is an organised, access-controlled folder — corporate documents, cap table, contracts, IP, compliance records — that investors' or acquirers' teams review during due diligence. Build it before the first serious funding conversation, not after a term sheet arrives, since assembling it under deadline pressure is when documents get missed.
Can incorporating too early hurt a startup?
Yes — incorporating before there's a real business means carrying ROC filings, statutory audits, and compliance costs for a company that hasn't found traction yet, with no revenue to offset the overhead. It's rarely the bigger risk compared to incorporating too late, but it's a real cost worth weighing against the benefit of formal entity protection.
Legal infrastructure isn't a milestone you hit once and move past. It's a system that has to stay current for as long as the company exists — updated every time a share moves, a contract gets signed, or a filing comes due. Founders who treat it that way from the start spend less, move faster through diligence, and never have to explain a messy cap table to an investor who was ready to write a cheque.
BuildWright builds and maintains every layer of this stack — incorporation, licences, contracts, and dispute resolution — so founders can focus on the product instead of the paperwork.