Key Legal Documents Every Startup in India Must Have Before Launch

Before an Indian startup launches, it needs three layers of paper: the documents that create the company (Certificate of Incorporation, Memorandum and Articles of Association), the documents that fix who owns what (founders agreement with vesting, IP assignments, ESOP policy, share issuance records), and the documents that govern dealings with the outside world (employment and contractor agreements, customer terms, privacy policy, and the statutory registrations). Everything else is a variation on those three. Founders in Bengaluru routinely get the first layer right and the second layer wrong, and the second layer is the one that decides whether a funding round closes.

Part of the corporate and commercial law practice at S Jain & Attorneys, Bangalore.

This guide sets out what each document does, which law it sits under, and when it has to exist. It is written for a founder who is about to launch and wants to know what is genuinely load bearing rather than what a template pack will sell them.

The launch checklist at a glance

Use this as a map. The detail on each item follows below.

1. Incorporation documents

• Certificate of Incorporation: issued by the Ministry of Corporate Affairs on registration as a Private Limited Company, LLP or One Person Company. It carries the Corporate Identity Number and is the document every bank, investor and landlord will ask for first.
• Memorandum and Articles of Association (MoA and AoA): sections 4 and 5 of the Companies Act, 2013 govern these. The MoA states the objects and capital; the AoA is the internal rulebook covering share transfers, board composition, quorum and reserved matters.

Founders often treat the AoA as boilerplate. It is not. When an investor comes in, the shareholders agreement has to be mirrored into the Articles to be enforceable against the company, and a poorly drafted set of Articles has to be amended by special resolution before the round can close. Getting the transfer, pre-emption and board provisions sensible at incorporation saves a fight at Series A.

The first layer is three documents, and the third is the one founders wrongly treat as boilerplate.

2. Founders agreement and vesting

A founders agreement is the single highest-value document a startup signs, because it is the only one written while everyone still likes each other. It should cover:

• Equity split and a vesting schedule (four years with a one-year cliff is the market standard, though nothing in law requires those numbers).
• Roles, titles, time commitment and what happens if a founder takes another job.
• Decision making: which matters need unanimity, which go to a simple majority, and how deadlock is broken.
• IP assignment: every line of code, design and document created by a founder, including work done before incorporation, must be assigned to the company.
• Exit terms: good leaver and bad leaver treatment, buyback price and the mechanism for it.
• Confidentiality and non-solicitation.

Key takeaway. Vesting is not a sign of distrust between founders. It is the mechanism that protects the founders who stay. Without it, a co-founder who leaves in month seven walks away with a permanent third of the company, and the remaining founders spend the next funding round explaining a dead equity holder to investors who will refuse to fund around it.

3. Getting the IP into the company

This is where the most expensive mistakes happen, because the default rules of Indian law do not do what founders assume.

Under section 17 of the Copyright Act, 1957, the author of a work is the first owner of copyright, subject to specific exceptions. Work created by an employee in the course of employment under a contract of service generally vests in the employer. Work created by an independent contractor under a contract for services does not. So the freelance developer who built your first version, the designer who drew your logo and the agency that wrote your website copy all own what they made unless there is a written assignment. A diligence lawyer will find this in an afternoon.

For inventions, a provisional specification under the Patents Act, 1970 buys you a priority date cheaply. But section 9(1) of that Act is unforgiving: a complete specification must be filed within twelve months of the provisional, failing which the application is deemed abandoned. There is no discretionary extension to rescue a diarised date that nobody diarised. A granted patent runs for twenty years from the filing date under section 53.

For the brand, file a trademark application under the Trade Marks Act, 1999 in the classes that match what you actually sell. Registration gives a statutory infringement action under section 29; an unregistered mark is limited to the common law action of passing off, which is slower and harder to prove.

Common mistake. Founders assume that paying an invoice buys the intellectual property. It does not. Payment buys a licence to use at best. If your contractor agreement has no express assignment clause, the contractor remains the first owner of the copyright in the code or design under section 17 of the Copyright Act, 1957, and can in principle license the same work to a competitor.

4. Employment, contractor and ESOP paperwork

Employment contracts should carry confidentiality, IP assignment, notice, and non-solicitation of employees and customers. What they should not carry, at least not as a headline promise to the founder, is a post-employment non-compete. Section 27 of the Indian Contract Act, 1872 makes every agreement in restraint of a lawful profession, trade or business void to that extent. In Niranjan Shankar Golikari v. Century Spinning and Manufacturing Co. Ltd. (Supreme Court, AIR 1967 SC 1098) the Court upheld a negative covenant operating during the term of employment as reasonable and necessary to protect the employer, while drawing the line at restraints that bite after the employment ends. In practice, confidentiality, trade secret protection and non-solicitation clauses do the work that founders think a non-compete will do, and they are enforceable.

On ESOPs, section 62(1)(b) of the Companies Act, 2013 read with the Companies (Share Capital and Debentures) Rules, 2014 is the statutory route. The scheme needs a special resolution of shareholders and the resolution has to be filed with the Registrar. Announcing options in an offer letter before the scheme exists creates a promise the company cannot lawfully perform on the terms promised.

On workplace safety compliance, the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 requires every employer to constitute an Internal Committee by order in writing under section 4. Section 6 makes clear that the district Local Committee handles complaints only where an Internal Committee has not been constituted because the workplace has fewer than ten workers. Section 26 makes non-compliance punishable with a fine which may extend to fifty thousand rupees, doubled on a second conviction. This is a two-page order and a policy document, and it is one of the cheapest compliance items on the whole list to fix.

5. Customer-facing documents and the DPDP Act

Terms of service, a privacy policy and a refund and cancellation policy are not decoration. Payment gateways and app stores will ask for them before they onboard you, and they are the first documents a consumer forum reads.

The Digital Personal Data Protection Act, 2023 is the governing statute for personal data. Its architecture is simple enough to design for: section 5 requires a notice, in plain language, telling the individual what data is being collected and for what purpose, and how she can exercise her rights and complain; section 6 requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to what is necessary for the stated purpose; section 8 places the compliance burden on the data fiduciary irrespective of any contract to the contrary, requires reasonable security safeguards, and requires intimation of a personal data breach to the Data Protection Board and to each affected individual; and section 9 requires verifiable parental consent before processing a child's personal data.

The penalties in the Schedule to the Act are not token. A failure to take reasonable security safeguards can attract a penalty extending to two hundred and fifty crore rupees, a failure to notify a breach up to two hundred crore rupees, and a breach of the children's data obligations up to two hundred crore rupees. The Digital Personal Data Protection Rules, 2025 were notified in November 2025 with a staggered commencement, so the operative dates for individual obligations differ. Build consent, notice and deletion into the product now rather than retrofitting them, and check the current commencement position before you assume an obligation has not started.

6. Registrations you also need on day one

Bengaluru founders consistently underestimate this layer because none of it is glamorous.

• Shops and establishments: under section 4(3) of the Karnataka Shops and Commercial Establishments Act, 1961, the employer must file the prescribed statement with the Inspector within thirty days of the establishment commencing work. Section 4(2) requires the registration certificate to be prominently displayed at the establishment, and section 4(3A) provides for deemed registration if the Inspector does not communicate a reasoned refusal within thirty days. Section 6A requires written appointment orders to employees within thirty days of appointment.
• GST: section 22 of the Central Goods and Services Tax Act, 2017 sets the base threshold of twenty lakh rupees of aggregate turnover, with a proviso allowing the Government to raise it to forty lakh rupees for suppliers dealing exclusively in goods. Section 24 imposes compulsory registration regardless of turnover in listed cases, including persons making inter-State taxable supplies and persons supplying through an e-commerce operator that collects tax at source. Section 25(1) gives you thirty days from becoming liable to apply.
• Provident fund: the Employees' Provident Funds and Miscellaneous Provisions Act, 1952 applies under section 1(3) to establishments employing twenty or more persons, with power in the Central Government to notify a lower number.
• Professional tax: a Karnataka state levy on the employer and on employees, taken along with the incorporation filing through the linked AGILE-PRO-S form.

7. The post-incorporation filings founders forget

Incorporation is not the finish line. Three deadlines run from the date of incorporation itself, and missing them is one of the most common reasons a young company shows up in diligence with a compliance defect.

1. Hold the first board meeting within thirty days of incorporation. Section 173(1) of the Companies Act, 2013 requires it, and thereafter a minimum of four board meetings a year with no more than one hundred and twenty days between consecutive meetings.
2. Appoint the first auditor within thirty days of registration. Section 139(6) puts this on the Board. If the Board fails, it must inform the members, who then appoint at an extraordinary general meeting within ninety days.
3. Bring in the subscription money and file the commencement declaration. Section 10A requires a director to file a declaration with the Registrar within one hundred and eighty days of incorporation that every subscriber has paid the value of the shares agreed to be taken, together with verification of the registered office. Until that is done, a company with share capital cannot lawfully commence business or exercise borrowing powers. This is Form INC-20A.
4. Issue share certificates and start the statutory registers. Register of members, register of directors, register of charges, and minutes of board and general meetings.
5. Complete the founders and contractor IP assignments and stamp them. Unstamped or insufficiently stamped assignment deeds create an evidentiary problem exactly when you need the document most.
6. File the trademark application and, if there is an invention, the provisional specification. Diarise the twelve-month complete specification deadline under section 9(1) of the Patents Act, 1970 the same day you file the provisional.

Deadline warning. Three clocks start on the day the Certificate of Incorporation is issued and none of them are reminded to you: thirty days for the first board meeting under section 173(1), thirty days to appoint the first auditor under section 139(6), and one hundred and eighty days to file the section 10A commencement declaration. A company that has not filed the section 10A declaration cannot lawfully commence business or borrow, which is an awkward discovery to make halfway through a term sheet.

What actually goes wrong: notes from practice

What we tell founders who come in with a signed term sheet and a diligence checklist is that the problems are almost never the ones they were worrying about. Nobody has ever lost a round over the wording of their privacy policy. Rounds get delayed, repriced or restructured over three things: intellectual property that sits with a person rather than with the company, because the first two engineers were friends on invoice and nobody papered an assignment; equity that was promised in a WhatsApp message or an offer letter and never converted into a lawful instrument, so the cap table on record and the cap table people believe in are different documents; and a founders agreement that was never signed because signing it felt like planning for a divorce. The founders who close cleanly are not the ones with the thickest document pack. They are the ones who can produce, on the day of the request, a signed assignment from every person who ever wrote code for them and a cap table that reconciles to the register of members. Build that habit in the first month, when it takes an afternoon, rather than in the fourth year, when it takes a chain of consent letters from people who have since moved to other companies and are no longer inclined to help.

Frequently Asked Questions

Getting these documents right at the start is far cheaper than litigating them later; a startup-focused advocate can tailor them to your structure and funding plans.

This article is for general informational purposes only and does not constitute legal advice. Please consult a qualified advocate about your specific matter.

Related guides and where to get help

If this is a live problem rather than background reading, our corporate and commercial practice handles these matters from Bengaluru, including for clients who cannot attend court in person. These guides go deeper on the neighbouring questions:

• Founders Agreement for Startups in India: The Complete Guide
• Term Sheet in Startup Funding: What Every Founder Should Know
• Legal Due Diligence in M&A: What It Is and How It Works