An independent guide for foreign investors, published by IMC, A Member Firm of Andersen Global connect@intuitconsultancy.comAbout IMCContact

Technology & SaaS

What to watch: technology and SaaS

Data protection, tax presence and ownership tests drive compliance risk for technology investors. Each item below sets out the rule as of 1 October 2026 and what it means for a foreign group.

₹250 croreMaximum DPDP penalty for failing to take reasonable security safeguards
13 May 2027DPDP core duties on notice, consent and breach reporting apply
₹2 croreSignificant economic presence threshold on payments from India
10%Land-border ownership above this, or with control, stays on the government route
Facts as of 1 October 20267 sources citedHow we keep this current

Compliance watch-outs

The brochure names six watch-outs for technology investors. They are set out first, followed by further points drawn from the tax, incentive and set-up pages that commonly catch foreign groups out.

DPDP penalties are large

Penalties under the data-protection regime reach ₹250 crore for failing to take reasonable security safeguards. The core duties on notice, consent and breach reporting apply from 13 May 2027. Consent managers register from 13 November 2026, and the Data Protection Board of India has operated since the DPDP Rules 2025 were notified on 13 November 2025. Cross-border transfers are allowed by default unless restricted by government notification (Invest India legal guide, Dec 2025).

Tax presence without an entity

Significant economic presence can arise above ₹2 crore of payments from India or 300,000 Indian users, with no office or staff in India, unless a tax treaty’s permanent-establishment test gives relief. Withdrawal of the 6% equalisation levy from 1 April 2025 did not remove this exposure (Accorp and Gala alerts, secondary). Remote suppliers of software and SaaS should count Indian payments and users before deciding against an entity; see tax and zones.

Data-centre exemption conditions

The exemption to the tax year ending 31 March 2047 applies only if the foreign company is notified by the Central Government, does not own or operate the data centre, sells to Indian users only through an Indian reseller and furnishes prescribed information (Finance Act 2026). The 15% safe harbour on cost for related-party data-centre services was only proposed in Budget 2026-27; confirm its notification before relying on it.

Indian ownership for chip-design support

Semicon 2.0 design support is limited to companies incorporated and headquartered in India and owned and controlled by Indian citizens (or OCIs, for commercial design). FDI in semiconductor design is open at 100% under the automatic route, but a foreign-controlled subsidiary does not qualify for the support; foreign groups can take part as partners (ANI, 2026). The same Indian-ownership point applies to the Design Linked Incentive, which is directed at domestic companies, start-ups and MSMEs.

Online money games are banned

The online gaming Act of 2025, in force with its Rules from 1 May 2026, prohibits online money games. E-sports, and online social games in categories the government notifies, register with the Online Gaming Authority of India (PIB, Apr 2026; Shardul Amarchand Mangaldas, 25 Apr 2026).

Land-border ownership is tested

Under Press Note 2 (2026), beneficial ownership is defined as under the PMLA. Land-border ownership above 10%, or with control, keeps an investment on the government route. Up to 10% non-controlling land-border beneficial ownership can use the automatic route, with prior reporting on the FIF/NSWS portal. In telecom, land-border investors need government approval. See land-border investors.

Further points from the brochure

Inventory e-commerce is still barred for domestic sales

Press Note 3 (2026) of 23 July 2026, in force from 3 September 2026, lets marketplace entities with FDI hold inventory to export goods made in India. Domestic inventory sales stay barred, and the marketplace platform may not own the inventory it sells to consumers (EY, Sep 2026, secondary).

Digital news is capped

Uploading or streaming news and current affairs through digital media is capped at 26% under the government route. Other software and platform businesses follow the general 100% automatic rule.

Telecom needs its own authorisation

Telecom services, including internet service providers, are 100% automatic, but an authorisation under the Telecommunications Act 2023 from the Department of Telecommunications is needed to establish, operate, maintain or expand a network or to possess radio equipment.

The STP domestic-sales ceiling

An STP unit may sell in India only up to 50% of its exports. A business that expects a large Indian customer base should test this ceiling before choosing the STP route over an SEZ or a domestic unit.

Treaty exits face GAAR

Treaty exemptions on capital gains are open to challenge under GAAR after the Supreme Court denied India–Mauritius treaty benefit to Tiger Global in January 2026 (Khaitan & Co, 16 Jan 2026; KPMG, 20 Jan 2026).

Start-up tax holiday conditions

The s.140 deduction of 100% of profits for three consecutive tax years out of the first ten needs incorporation before 1 April 2030, turnover up to ₹300 crore (raised from ₹100 crore by the Finance Act 2026) and an Inter-Ministerial Board certificate. DPIIT recognition alone is not enough.

State incentives are ceilings, paid over time

State amounts are ceilings, and eligibility, zones and disbursal schedules are set by each policy. Uttar Pradesh, for example, pays its 10% capital subsidy in annual instalments over five years after commercial operations begin, and limits its EPF reimbursement to specified groups of UP-domicile staff. Karnataka and Telangana offer technology incentives that the brochure does not summarise.

Central schemes are aimed at Indian entities

The IndiaAI compute portal serves Indian start-ups, academia, researchers and government entities. Schemes marked “announced” need their operating guidelines checked before they go into a business case; see central incentives.

Labour Codes and hiring support

The four Labour Codes apply from 21 November 2025. The Employment Linked Incentive (up to ₹3,000 a month per additional employee, for two years) covers only jobs created between 1 August 2025 and 31 July 2027 (PIB, 2025).

What to check next

  • Put 13 November 2026 and 13 May 2027 into the DPDP programme plan and budget for security safeguards now.
  • Count Indian payments and users against the ₹2 crore and 300,000 thresholds, and check the relevant treaty’s PE article.
  • If you sell cloud services from Indian data centres, confirm notification, the reseller structure and that you neither own nor operate the facility.
  • Trace beneficial ownership to the PMLA standard before choosing the automatic route.
  • Review the product line for anything that could be classed as an online money game.

Planning your move into India?

Talk to IMC about your entry structure, approvals, incentives, tax and the first year of compliance.

Book a discovery conversation