E-commerce Compliance Checklist for Indian Founders: GST, Legal Metrology, DPDP & More

Why Compliance Matters for Your E-commerce Business

Building an e-commerce store feels exciting until you realize you need to handle GST, data protection, product standards, and customer policies all at once. Many Indian founders skip this or do it halfway, then face penalties, legal notices, or customer disputes. The good news: compliance is not complicated if you tackle it upfront.

This checklist covers the main areas you need to cover. This is general guidance, not legal advice; consult a compliance professional for your specific situation.

GST Registration and Compliance

If your annual turnover exceeds 20 lakh rupees (or 10 lakh for services in some cases), you must register for GST.

• Register on the GST portal and obtain your GSTIN.
• File GSTR-1 (outward supplies) monthly or quarterly depending on your turnover.
• File GSTR-3B (summary return) by the due date each month.
• Maintain invoices and records for at least five years.
• Charge the correct GST rate for your product category.

If you sell across state lines, inter-state GST rules apply. A bookkeeper or accountant familiar with GST is a worthwhile investment here.

Legal Metrology for Packaged Goods

Selling packaged products (food, cosmetics, cleaning supplies, etc.)? You must comply with Legal Metrology standards.

• Display net quantity, unit price, and manufacturer details clearly on the package.
• Include expiry dates where relevant.
• Use approved weights and measures.
• Get your packaged goods verified by a Legal Metrology officer if required.

Ignoring this can result in consumer complaints and enforcement action.

Data Protection Under DPDP Act

The Digital Personal Data Protection Act applies to how you collect, store, and use customer data.

• Be transparent about what personal data you collect and why.
• Get explicit consent before collecting sensitive data.
• Store data securely and do not share it without permission.
• Respond to customer requests to access or delete their data within 30 days.
• Have a data protection officer if you process large volumes of personal data.

A well-built website enforces this from the start: encrypted data storage, clear privacy policies, and consent mechanisms built in.

FSSAI If You Sell Food or Beverages

Selling packaged food, beverages, or edibles online? FSSAI registration is mandatory.

• Apply for FSSAI license based on your business type (manufacturer, trader, distributor).
• Display the FSSAI number on your website and packaging.
• Follow food safety standards for storage and labeling.
• Maintain hygiene certificates and supplier documentation.

Refund, Return, and Shipping Policies

These are not optional. Indian consumer protection law requires clear, accessible policies.

• State your refund window clearly (e.g., 7, 14, or 30 days).
• Explain how customers initiate returns and what happens next.
• Clarify who pays return shipping and under what conditions.
• Specify expected delivery timelines and what constitutes a delay.
• Display these prominently on your website (not buried in a link).
• Update your terms and conditions if policies change.

Missing or vague policies invite customer complaints and regulatory action.

Your Next Step

Do not try to handle everything at once. Start with GST and data protection, then add Legal Metrology and FSSAI as needed for your product category. Get a compliance checklist in writing, and review it every quarter.

Building a secure, compliant website from day one saves you time and legal headaches later.

This article is general information, not legal advice. For your specific situation, please consult a qualified professional.