Four legal changes now shape how businesses in India run: a new data protection regime, four Labour Codes, three new criminal laws and a new Income-tax Act. Each one changes paperwork, contracts and internal processes, and most businesses I speak with have acted on one or two of them, not all four.
This guide sets out what changed, when it took effect, and the practical steps I would take this quarter. It is written for founders, finance heads and compliance teams who want a clear checklist rather than a legal treatise.
The four changes at a glance
| Change | In force from | Who it affects most | First step |
|---|---|---|---|
| Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 | Rules notified November 2025, obligations phased over 18 months | Any business that collects customer or employee data | Map what personal data you hold and why |
| Four Labour Codes (Wages, Industrial Relations, Social Security, Occupational Safety) | 21 November 2025 | Every employer, including those using contract staff and gig workers | Review salary structures, appointment letters and registers |
| Bharatiya Nyaya Sanhita, Bharatiya Nagarik Suraksha Sanhita, Bharatiya Sakshya Adhiniyam | 1 July 2024 | Businesses dealing with fraud, complaints, investigations and evidence | Update policies, templates and section references |
| Income-tax Act, 2025 | 1 April 2026 | All taxpayers, payroll and accounts teams | Update systems and documents to the new “tax year” terms |
Data protection: the DPDP Act and Rules
The Digital Personal Data Protection Act, 2023 now has its operating rules. The government notified the DPDP Rules in November 2025 and gave businesses a phased timeline: the Data Protection Board provisions took effect straight away, Consent Manager registration follows after about 12 months, and most of the core obligations apply after 18 months, in 2027. The Ministry of Electronics and Information Technology publishes the Act and Rules on its official website.
Eighteen months sounds generous. In practice it is not, because the work is spread across systems, vendors and people.
What the law expects
- A clear notice telling people what data you collect and why, in plain language.
- Consent that is free, specific and easy to withdraw, with a record that it was given.
- Reasonable security safeguards and a process to report a personal data breach.
- Deleting data once its purpose is over, unless another law requires you to keep it.
- A way for people to ask for access, correction or erasure, and a working grievance channel.
What to do this quarter
Start with a data map: every form, app, spreadsheet and vendor that touches personal data. Then rewrite your privacy notice and consent wording, and add data protection clauses to vendor contracts. Contracts are where I see the biggest gap, because a processor’s mistake is still your problem under the Act. I cover the clauses that matter in my note on contracts that drive growth and protect value.
The four Labour Codes
The Code on Wages, the Industrial Relations Code, the Code on Social Security and the Occupational Safety, Health and Working Conditions Code came into force on 21 November 2025. Together they replace 29 central labour laws. The Ministry of Labour and Employment carries the notifications on its website. Some central and state rules came later, so check the rules that apply in each state where you employ people.
Changes that touch most employers
- A common definition of wages. Allowances above a set share of total pay are added back to wages, which can raise gratuity and provident fund costs. Many salary structures need to be redrawn.
- Appointment letters. Written appointment letters for workers are now a requirement, not good practice.
- Fixed-term employment is recognised across sectors, with benefits in proportion to the term.
- Social security for gig and platform workers is brought into the framework.
- Registers and returns move towards single, often electronic, filings.
What to do this quarter
Ask payroll to model the new wage definition against your current structure, and budget for any rise in gratuity and PF. Refresh appointment letter and contract templates, and review how contract labour and consultants are engaged. If your structure leans heavily on allowances, fix it before the next salary cycle rather than in the middle of a dispute.
The new criminal laws
From 1 July 2024, the Bharatiya Nyaya Sanhita replaced the Indian Penal Code, the Bharatiya Nagarik Suraksha Sanhita replaced the Code of Criminal Procedure, and the Bharatiya Sakshya Adhiniyam replaced the Indian Evidence Act. The texts are on India Code.
For a business, the impact shows up in three places.
- References. Policies, notices, complaint templates and board papers that cite IPC or CrPC sections now point to repealed laws.
- Fraud and cheating. Offences such as cheating, criminal breach of trust and forgery carry new section numbers, and organised crime has its own provision.
- Electronic evidence. The new evidence law treats electronic records as primary evidence in many situations and sets out how they are certified. How you store emails, system logs and CCTV footage now matters more.
What to do this quarter
Run a search across your policy library for “IPC”, “CrPC” and “Evidence Act” and update every reference. Then look at how you preserve digital records during an internal inquiry. A clean chain of custody for laptops, emails and logs often decides whether a fraud complaint holds up. My note on risk management in a hyperconnected world covers incident response in more detail.
The Income-tax Act, 2025
The Income-tax Act, 2025 came into force on 1 April 2026 and replaced the Income-tax Act, 1961. The most visible change is the “tax year”: the old split between “previous year” and “assessment year” gives way to a single twelve-month tax year that starts on 1 April. Income earned up to 31 March 2026 is still handled under the old Act. The income tax department’s e-filing portal carries the current forms.
What to do this quarter
- Update invoices, contracts and payroll documents that refer to old section numbers, especially for TDS.
- Check that your accounting software and payroll vendor have moved to the new structure.
- Keep two tracks in mind for a while: past years under the 1961 Act, new years under the 2025 Act.
Who should own each change
In most businesses, regulatory work stalls because everyone assumes someone else is handling it. A simple split of ownership fixes that faster than any software.
| Change | Natural owner | Who they need to involve |
|---|---|---|
| Data protection | A senior manager in operations or technology | IT, marketing, HR and every vendor that handles personal data |
| Labour Codes | HR head | Payroll, finance and the managers who engage contract staff |
| Criminal laws | Legal or compliance lead | Internal audit and whoever runs internal inquiries |
| Income-tax Act | Finance head | Accounts, payroll and the external tax adviser |
Smaller businesses may have one person wearing several of these hats, which is fine. What matters is that each item has a name against it, a target date and a short note of what was done. That record is also useful later, because regulators and courts tend to look at whether a business made a genuine, documented effort to comply.
I also suggest a short review every quarter. Rules under these laws continue to be notified, and state governments issue their own rules under the Labour Codes, so a plan written once and never revisited goes out of date quickly.
Employers who want the Codes applied to their own contracts, policies and salary structures can find the detail on VIVS Legal’s employment law services page.
A simple order of work
If you can only do a few things this quarter, I would take them in this order:
- Data map and vendor contracts (DPDP), because the timeline is fixed and the work is slow.
- Salary structure review (Labour Codes), because it affects cost and every employee.
- Policy and template clean-up (criminal laws and tax), because it is quick and reduces risk at once.
- A short board or partner briefing, so that decisions are recorded and owners are named.
Regulatory change is easier to manage when one person owns each item and there is a date against it. Compliance done in a rush, after a notice or a dispute, always costs more.
Closing thought
None of these changes is a one-time filing. Each one sits inside contracts, payroll, IT systems and daily decisions, which is why they need a plan rather than a single meeting. If you would like to talk through how these changes apply to your business, you can reach me through the contact page, or read more about my background.
Frequently asked questions
When do the main DPDP Act obligations apply to businesses?
The DPDP Rules were notified in November 2025 with a phased timeline. Data Protection Board provisions applied at once, Consent Manager registration follows after about 12 months, and most core obligations, such as notice, consent, security safeguards and breach reporting, apply after 18 months, in 2027. Preparation should start well before then.
Do the Labour Codes change how salaries should be structured?
Yes, for many employers. The Codes use a common definition of wages, and allowances above a set share of total pay are added back to wages. This can raise gratuity and provident fund contributions, so salary structures that rely heavily on allowances should be reviewed and costed before the next salary cycle.
Are old IPC and CrPC references in company policies still valid?
No. From 1 July 2024 the IPC, CrPC and Indian Evidence Act were replaced by the Bharatiya Nyaya Sanhita, Bharatiya Nagarik Suraksha Sanhita and Bharatiya Sakshya Adhiniyam. Policies, complaint templates and notices that cite the old sections should be updated so that they refer to the laws now in force.
What is a tax year under the Income-tax Act, 2025?
A tax year is the twelve-month financial year starting on 1 April. It replaces the separate previous year and assessment year used under the 1961 Act. Income earned up to 31 March 2026 is still dealt with under the old Act, while income from 1 April 2026 falls under the new framework.
Which regulatory change should a small business deal with first?
Start with the data protection work, because it involves systems, forms and vendor contracts and takes the longest. Then review salary structures under the Labour Codes, and finally update policies and templates for the new criminal laws and the Income-tax Act. Naming one owner and a date for each item keeps the work moving.
