How to start a mobile app startup in India: registrations and legal requirements

Choosing a structure

App startups raise seed and venture money, issue ESOPs to developers and often take foreign investment, so a private limited company is the standard choice. Founders should assign all code, designs and domain names to the company from day one, because investors check IP ownership closely.

DPIIT recognition is available to companies within 10 years of incorporation with turnover never above ₹200 crore, under the February 2026 notification, and brings scheme access and some compliance relief.

Registrations and approvals

Most registrations are corporate and tax. Sector rules matter more than registrations for apps, so map your business model against them before writing code or launching on app stores.

Tax on app revenue

Subscriptions, in-app purchases and advertising revenue from Indian users are generally taxable services at 18%. When you sell through app stores operated by foreign companies, the commission they charge may be an import of services on which you pay GST under reverse charge, depending on the billing model. Check how each store invoices you.

Revenue from overseas users may qualify as export of services if conditions are met. File an LUT to invoice without IGST. Angel tax on share premium was abolished from financial year 2024-25, which simplifies funding rounds.

Data protection and platform rules

The DPDP Rules 2025 were notified in November 2025. Duties on notices, consent, security safeguards, breach reporting within the prescribed timelines, data retention and children's data apply from 13 May 2027. Large social media, gaming and e-commerce apps face extra retention and deletion rules.

Apps where users post content are intermediaries under the IT Act and must follow the IT Rules 2021, including terms of use, a grievance officer and takedown timelines. Apps selling goods or services must follow consumer protection and e-commerce rules on pricing, refunds and grievances.

Gaming and regulated sectors

The Promotion and Regulation of Online Gaming Act 2025 took full effect on 1 May 2026 after the Online Gaming Rules 2026 were notified. It bans online money games, whether based on skill or chance, along with their advertising and payment processing. E-sports and social games without money stakes are permitted under oversight of the Online Gaming Authority of India.

Apps offering lending, payments, insurance or investment services need licences from RBI, IRDAI or SEBI, or must partner with licensed entities. These are specialist regulatory processes; take expert advice before building such features.

Working with developers and agencies

Many app startups build their first version with freelancers or development agencies. Use written contracts that assign all intellectual property in code, designs and documentation to your company, require source code handover and restrict reuse of your proprietary work for other clients.

Deduct TDS on payments to Indian developers where required, and check reverse charge GST and withholding rules when paying overseas developers. Keep repositories, cloud accounts and app store developer accounts in the company's name, not an individual's.

Pitfalls for app founders

App store policies often move faster than law, so align your privacy notice and data practices with both Indian law and store requirements before submission.

• Founders or freelancers owning code instead of the company.
• Collecting more personal data than the app needs.
• Building money-based gaming features after the 2025 ban.
• Launching lending or payment features without a regulated partner.

Step by step

1. 1Incorporate

   Register a private limited company and open a bank account.

2. 2Secure IP

   Assign code, designs and domains to the company in writing.

3. 3Register for GST

   Set up invoicing and reverse charge on app store fees where applicable.

4. 4Draft legal documents

   Terms of use, privacy notice and grievance process.

5. 5Map sector rules

   Check gaming, fintech, health or education regulations for your model.

6. 6Plan DPDP compliance

   Data mapping, consent flows and security before May 2027.

7. 7Apply for DPIIT recognition

   Once eligible, for scheme access and benefits.