The provisions

The sections a small business actually runs into.

What each provision requires, what it costs to ignore, and where people get it wrong — in plain English, with the document or calculator that acts on it.

Check your compliance exposure — free

Provisions covered

Section 15, Micro, Small and Medium Enterprises Development Act, 2006 — A buyer must pay a micro or small enterprise within 45 days of acceptance — no contract clause can extend this period.
Section 16, Micro, Small and Medium Enterprises Development Act, 2006 — Compound interest with monthly rests at 3× the RBI bank rate on any payment late to a registered micro or small enterprise. No contract can waive it.
Section 18, Micro, Small and Medium Enterprises Development Act, 2006 — How an unpaid micro or small supplier takes a buyer to the MSME Facilitation Council: conciliation first, then arbitration, a decision due in 90 days, and the 75% deposit a buyer needs to challenge it.
Section 403, Companies Act, 2013 — ₹100 per day, per form, with no upper limit — and the clock does not stop until the form is actually filed.
Section 138, Negotiable Instruments Act, 1881 — A criminal remedy on three deadlines: 30 days to demand, 15 for the drawer to pay, one month to file.
Section 4, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — Ten workers of any kind makes an Internal Committee mandatory, and the external member is where most small committees fail.
Section 17, Code on Wages, 2019 — Monthly wages before the expiry of the 7th of the next month, daily, weekly and fortnightly limits, and wages due on an exit within two working days.
Section 2(y), Code on Wages, 2019 — Basic pay, dearness allowance and retaining allowance are wages; HRA, conveyance, overtime and the rest are not, until they exceed half of total pay and the excess is added back.
Section 53, Code on Social Security, 2020 — Five years' service (none for death, disablement or the end of a fixed term), fifteen days' wages a year on a 26-day month, a notified cap, and when gratuity can be forfeited.
Section 53, Code on Social Security, 2020 — Gratuity moved to s.53 of the Code on Social Security on 21 November 2025: the same 15/26 formula and ₹20 lakh cap, wider wages, and fixed-term staff after one year.
Section 35, Indian Stamp Act, 1899 — The contract stays valid. A court will not look at it until the duty and the penalty are paid.
Section 50, Central Goods and Services Tax Act, 2017 — 18% a year on tax paid after the due date — and 18% on input tax credit wrongly availed and actually used, from the day it was used.
Section 16, Central Goods and Services Tax Act, 2017 — Invoice, receipt, the supplier's filing, tax actually paid and your own return: the conditions for ITC, the 180-day payment rule, and the section 16(4) cut-off of 30 November.
Section 44, Central Goods and Services Tax Act, 2017 — Every regular registered person files an annual return reconciling the year's returns with the audited accounts: by 31 December under the Rules, and never more than three years after the due date.
Section 74A, Central Goods and Services Tax Act, 2017 — One section for every GST demand from FY 2024-25 onward: 42 months to issue the notice, 12 to decide it, and a penalty that paying within 60 days can wipe out.
Section 107, Central Goods and Services Tax Act, 2017 — Three months to appeal a GST order, the admitted amount plus 10% of the tax in dispute to file it, and recovery of the rest stayed once that is paid.
Section 47, Central Goods and Services Tax Act, 2017 — ₹100 a day under the CGST Act, and the same again under the State Act, up to ₹5,000 for a periodic return; for the annual return under s.47(2), up to 0.25% of turnover. Notifications lower the amount actually charged.
Section 92, Companies Act, 2013 — MGT-7 within sixty days of the annual general meeting (29 November after a 30 September AGM), with a penalty on the company and on its officers if it is late.
Section 454, Companies Act, 2013 — How the Registrar imposes a penalty for a company-law default, the thirty days that wipe it out for a late AOC-4 or MGT-7, and the sixty-day appeal to the Regional Director.
Section 164, Companies Act, 2013 — Who cannot be appointed a director, the five-year bar that follows three years of unfiled financial statements or annual returns, and the six months a new director gets.
Section 96, Companies Act, 2013 — When the AGM must be held (by 30 September for a March year-end), the nine months for the first one, the ROC's three-month extension, and the rules on time and place.
Section 139, Companies Act, 2013 — The first auditor within 30 days of incorporation, the five-year appointment at the first AGM, the notice to the ROC within 15 days, casual vacancies, and rotation.
Section 137, Companies Act, 2013 — AOC-4 within thirty days of the annual general meeting, with a penalty that reaches the directors who signed the accounts.
Section 5, Digital Personal Data Protection Act, 2023 — Before collecting personal data a Data Fiduciary must give a clear notice of what it collects, why, and how consent can be withdrawn. No notice means no lawful collection.
Section 6, Digital Personal Data Protection Act, 2023 — Consent must be free, specific, informed and unambiguous. Given for one purpose, it authorises nothing else. Withdrawal must be as easy as giving it.
Section 11, Digital Personal Data Protection Act, 2023 — A person whose data you hold can ask for a summary of it, what you do with it, and everyone you shared it with. Section 11 is the DSAR section.
Section 16, Digital Personal Data Protection Act, 2023 — Personal data may be sent abroad for processing unless the Central Government notifies the destination as restricted, and a stricter Indian law still prevails.
Section 8, Digital Personal Data Protection Act, 2023 — Accuracy, security safeguards, breach reporting, erasure when the purpose ends, and a grievance contact who answers.
Section 33, Digital Personal Data Protection Act, 2023 — The Board fixes the amount against the Schedule, where the ceiling for a security-safeguards failure is ₹250 crore.
Section 27, Indian Contract Act, 1872 — An agreement restraining anyone from exercising a lawful profession, trade or business is void to that extent — with one statutory exception.
Section 73, Indian Contract Act, 1872 — Compensation for loss that arose naturally from the breach, or that both parties knew was likely — and nothing remote.
Section 26, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — A fine of up to ₹50,000 for failing to constitute an Internal Committee or to comply with the Act, and more on repetition.
Section 7, Arbitration and Conciliation Act, 1996 — It has to be in writing, and it has to be an agreement to submit disputes to arbitration — a clause naming a city is not enough.
Section 43B(h), Income-tax Act, 1961 — Unpaid dues to registered micro and small enterprises beyond 45/15 days are disallowed as business expenses — under s.43B(h) to FY 2025-26, and s.37(2)(g) of the Income-tax Act 2025 from tax year 2026-27.
Section 2, Digital Personal Data Protection Act, 2023 — The words the rest of the Act runs on: personal data, processing, Data Fiduciary, Data Processor, Data Principal, child and personal data breach.
Section 3, Digital Personal Data Protection Act, 2023 — Digital personal data processed in India, and processing abroad that serves people in India. Paper that is never digitised, personal use, and data the person made public are outside it.
Section 4, Digital Personal Data Protection Act, 2023 — Personal data may be processed for a lawful purpose on consent or on a listed legitimate use, and on nothing else.
Section 7, Digital Personal Data Protection Act, 2023 — A closed list of uses that need no consent, one of which covers processing for the purposes of employment.
Section 9, Digital Personal Data Protection Act, 2023 — Verifiable parental consent before processing a child, and an outright bar on tracking, behavioural monitoring and targeted advertising.
Section 10, Digital Personal Data Protection Act, 2023 — A data protection officer based in India, an independent auditor, and a periodic impact assessment, for those the Government notifies.
Section 12, Digital Personal Data Protection Act, 2023 — A Data Principal may require her data to be corrected, completed, updated or erased, and erasure is refused only where a law requires keeping it.
Section 13, Digital Personal Data Protection Act, 2023 — Every Data Fiduciary must offer a readily available way to complain, and the Data Principal must use it before going to the Board.
Section 14, Digital Personal Data Protection Act, 2023 — A Data Principal may nominate someone to exercise her rights if she dies or becomes incapable of exercising them.
Section 15, Digital Personal Data Protection Act, 2023 — The person exercising the rights has duties too, and a false or frivolous complaint carries a penalty of up to ₹10,000.
Section 17, Digital Personal Data Protection Act, 2023 — Named situations where parts of the Act do not apply, and a power to exempt notified start-ups from some of it.
Section 32, Digital Personal Data Protection Act, 2023 — An undertaking the Board accepts bars proceedings on that matter, and breaking it is itself penalised.
Section 9, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — A written complaint to the Internal Committee within three months of the incident, or of the last in a series; the committee can allow three more, and a legal heir can complain if she cannot.
Section 11, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — The inquiry runs under the service rules or the prescribed procedure, both sides are heard and see the findings, the committee has civil-court powers, and it has ninety days to finish.
Section 13, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — The report within ten days of the inquiry, a recommendation of no action or of action and compensation, and sixty days for the employer to act on it.
Section 19, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — A safe workplace, the penal consequences and the IC order on display, regular awareness programmes, and support to the committee and the woman: ten duties every employer owes.
Section 21, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — The Internal Committee must prepare an annual report each calendar year and submit it to the employer and the District Officer.