
Key Takeaways
Every HR team eventually builds some version of a compliance checklist. Fewer teams keep it current once the Labour Codes, the DPDP Act Rules, and half a dozen state amendments land in the same year, which is roughly what’s happened in 2026.
This guide breaks the checklist down by where an employee sits in their lifecycle with your company, highlights what is new this year, and tells you what non-compliance really costs. If you want the full list of monthly and annual filing dates in one place, our HR Compliance Calendar India 2026 tool covers that separately, as this guide focuses on what to track and why it matters.
HR compliance means aligning every employment practice, including hiring, payroll, safety, exit, etc., with the labour, tax, and data protection laws that apply to your organisation. It is not one law, but a stack of Central Acts, state-specific rules, and sector-specific obligations that all apply simultaneously.
Take a mid-size company with 150 employees across two states. On day one of operating, it needs: PF registration (mandatory past 20 employees), ESI registration (if any employee earns ₹21,000 or less), Shops & Establishment registration in each state it operates, Professional Tax registration where applicable, and a POSH Internal Committee. Miss any one of these and your organization risks paying hefty fines and tarnishing your image.
A few shifts this year matter more than the rest of the checklist combined:
Wages, defined as basic pay plus Dearness Allowance (DA), must now make up at least 50% of an employee’s total CTC. Salary structures that push basic pay artificially low to reduce PF and gratuity outflow no longer comply. Employers who have not revised their CTC breakup since the Labour Codes took effect are very likely under-deducting PF every month without realising it.
The provisions of the DPDP Act were notified in November 2025, with a phased compliance runway extending into 2027 for full enforcement of consent, notice, and rights-handling provisions. For HR specifically: most day-to-day employee data processing, including payroll, attendance, performance records, statutory filings, etc., falls under the Act’s ‘legitimate use’ exemption for employment purposes, so explicit consent generally isn’t required for it.
What still needs consent is anything outside that scope: using employee photos for marketing, sharing data with third parties for their own purposes, or collecting data for optional activities like wellness programmes. Either way, employers are ‘Data Fiduciaries’ according to the Law and remain on the hook for purpose limitation, security safeguards, and breach notification to the Data Protection Board.
All 4 Labour Codes, including The Code on Wages, 2019, The Code on Social Security, 2020, The Industrial Relations Code, 2020, and The Occupational Safety, Health and Working Conditions Code, 2020, came into force from November 21, 2025, with Central Rules notified in May 2026.
State Rules are still being finalised in several states, which means employers are currently operating in a transition period: central provisions apply, but full operational clarity depends on your state’s rule notification status.
Let us go through the HR compliance checklist based on employee lifecycle stages:
Here is a handy table highlighting the compliance applicability thresholds:
| Compliance Area | Applicability Trigger | Filing Frequency |
|---|---|---|
| Provident Fund (PF) | 20+ employees | Monthly (by 15th) |
| ESI | Any employee earning ≤₹21,000/month | Monthly (by 15th) |
| Professional Tax | State-dependent (varies by state) | Monthly/state-specific |
| Gratuity | 10+ employees | On exit (5-year vesting) |
| POSH Internal Committee | 10+ employees | Ongoing + annual report |
| TDS on Salary | All employers deducting tax at source | Monthly deposit, quarterly return |
Statutory deadlines fall into 3 buckets:
Missing any one of them starts interest or fines based on the gravity of your default. Hence, here are a few of the recurring monthly deadlines to build into your payroll cycle:
| Compliance | Due Date |
|---|---|
| PF payment (ECR) | 15th of following month |
| ESI payment | 15th of following month |
| TDS deposit | 7th of following month |
| Professional Tax | State-specific (typically monthly) |
For the complete filing calendar, that includes quarterly and annual deadlines across every applicable Act, you can use our HR Compliance Calendar India 2026 tool.
Non-compliance carries specific penalty structures and, in some cases, criminal rather than purely financial. Here is a list of violations and the associated penalty structures:
| Act | Violation | Penalty |
|---|---|---|
| EPF Act, 1952 | Late contribution payment | 12% annual interest (Sec. 7Q) + damages of 1% per month of delay (post-2024 revision) |
| EPF Act, 1952 | Wilful default / false statements | Imprisonment up to 1 year, fine up to ₹5,000, or both (Sec. 14) |
| ESI Act, 1948 | Late contribution / default | Interest plus damages; imprisonment up to 2 years in serious cases |
| DPDP Act, 2023 | Data breach / non-compliance by Data Fiduciary | Financial penalties that can scale significantly for serious or repeated breaches |
A checklist tells you what to track, while an audit tells you whether you are actually tracking it. Most organisations run a lighter internal audit monthly, which is usually led by the payroll team. It checks PF, ESI, TDS against actual filings.
On the other hand, a full annual statutory audit is undertaken through an external labour law consultant or chartered accountant. Before either audit, you should keep the following ready:
Manually computing and verifying PF, ESI, PT, and TDS deadlines across multiple states is where most compliance challenges lie. Modern payroll management systems automate statutory deductions and filings against current rates, highlight CTC structures that fall short of the 50%-wages requirement, and keep digital registers audit-ready without manual verification at month-end. It enables you to have peace of mind as they stay up to date with the changing statutory norms and regulations.
Yes, though the specific obligations change with headcount. Even small startups must follow minimum wage, Shops & Establishment registration, and basic employee record-keeping requirements from day one, regardless of size.
The 50% wages rule requires that basic pay plus DA make up at least 50% of an employee’s total CTC, directly affecting how PF, gratuity, and bonus amounts are calculated.
A lighter payroll-led review monthly, with a full statutory audit, ideally by an external consultant, at least once a year, or more often for larger, multi-state organisations.