Ecommerce Website Compliance in India: The Invoice Fields, Legal Pages and Checkout Features Your Online Store Must Build (2026 Checklist)

Ecommerce Website Compliance in India: The Invoice Fields, Legal Pages and Checkout Features Your Online Store Must Build (2026 Checklist)

An Indian online store has to do four things in its software and content to stay on the right side of the rules: produce a proper GST tax invoice for every order, show the legal and policy pages that the Consumer Protection (E-Commerce) Rules expect, present prices honestly at checkout, and keep card and customer data out of places it should not be. This guide treats compliance as a build checklist for the website, meaning fields, pages, calculations and integrations, and leaves the tax decisions, such as whether you must register or whether TCS applies to you, to your chartered accountant. Where a rule is turnover-dependent or changes often, we say so and mark it TODO: verify with your CA rather than state a number as settled.

It is written for store owners, ecommerce managers and founders planning a new store or auditing an existing one. It replaces an earlier version of this article that spent most of its length on tax mechanics; those belong with your accountant, and what a website developer can actually be held to is the build side.

Disclaimer. Govindani Infotech is a web development company. We are not chartered accountants or lawyers, and this is not tax or legal advice. GST rates, thresholds and e-invoicing rules are amended by CBIC notifications several times a year. Check the current position on the GST portal and with your CA before relying on anything below.

If your catalogue still shows old GST slabs, fix that first. GST rates were restructured in September 2025, and a catalogue priced against the old slabs charges the wrong tax on every order. Our GST 2.0 checkout and catalogue audit covers that specific job.

What your accountant decides and what your website does

It helps to split the work cleanly.

Your CA decides: whether you must register for GST and where, which rate applies to each product category, whether your turnover triggers e-invoicing, whether you are subject to TCS because you also sell on marketplaces, and how you file returns.

Your website does: store the data the CA's decisions depend on (GSTIN, HSN codes, state of supply), calculate tax the way the CA instructs, produce documents in the required format, display the required disclosures, and keep records that reconcile. If a developer builds this loosely, your CA inherits a mess. If you hand the developer a clear brief from the CA, the build is straightforward.

A practical first step is a thirty-minute call between your CA and your developer, or a short written note from the CA covering: your GSTIN or registration status, the HSN codes and rates for your products, whether you need e-invoicing, and any special treatment such as exempt items or composite supplies. Put that note in your project folder.

1. The GST tax invoice your store must generate

A tax invoice is a document with prescribed content, and an order-confirmation email is not automatically one. For a registered seller, the invoice commonly needs to show the following. Confirm the exact list for your case with your CA, because it varies with turnover and type of supply.

• Supplier name, address and GSTIN.
• A unique, sequential invoice number, within the limits the rules set for length and character types.
• Invoice date.
• Customer name and delivery address, and the customer's GSTIN for business buyers.
• Description of each item, and its HSN code. The number of HSN digits required depends on your turnover band. TODO: verify with your CA the digit requirement for your turnover.
• Quantity, taxable value, discount, and tax rate.
• A tax breakup: CGST and SGST for sales within your state, IGST for sales to another state, shown as separate lines.
• Place of supply.
• Total invoice value.

What the developer builds

1. An HSN field on every product in the catalogue, filled in and maintained, not typed per order. For stores with variants, check that each variant inherits the right code.
2. A tax rate field linked to the HSN or category, so a rate change is made once. Keep a note of the effective date for any change.
3. State-based tax logic. Compare the supply state (your registered state or the warehouse state) with the customer's delivery state. Same state means CGST plus SGST, different state means IGST. This must be calculated per order, not a flat percentage.
4. Prices that include or exclude tax consistently. Indian consumer prices are normally tax-inclusive, so the invoice must back-calculate the taxable value and tax from the displayed price. Test rounding on multi-item orders, because line-by-line and invoice-level rounding can differ by a few paise and your accounts must match the invoice.
5. Sequential numbering that cannot be edited or reused. If an order is cancelled, the invoice is cancelled through a credit note, not deleted. Do not let administrators delete issued invoices.
6. Automatic PDF generation at the point your CA says the invoice must be issued, typically on dispatch, and delivery by email and in the customer's account.
7. Credit notes for returns and refunds, linked to the original invoice. Our guide to building a returns page and return-request flow explains how the refund side connects.
8. Separation of channels. If you sell on a marketplace as well as your own site, tag each order by channel so your accounts can treat them separately.

Most small stores use their platform's invoice features plus a plugin or an accounting integration with a tool such as Zoho Books, Tally or similar. Test with real order types before launch: a same-state order, an other-state order, an order with a discount code, an order with two tax rates in one cart and a partial refund. For platform-specific setups see our guides to GST invoicing on Shopify and GST invoices on WooCommerce.

E-invoicing

E-invoicing means registering an invoice on the government's Invoice Registration Portal and printing the resulting reference number and QR code on it. It applies to businesses above a prescribed turnover threshold, which has been lowered in stages and has stood at ₹5 crore of annual aggregate turnover in recent years, and it mainly concerns business-to-business and export invoices. TODO: verify with your CA whether the threshold has changed and whether you are covered. If you are, the build is an integration: your store or your accounting software sends each invoice to the portal and stores the returned reference. Do not attempt this with manual uploads if you have meaningful order volume. Our guide on integrating GST e-invoice generation on a Pune ecommerce site goes through the technical steps.

2. The legal and policy pages

The Consumer Protection (E-Commerce) Rules, 2020 apply to e-commerce entities and set out information a store has to make available and a grievance process it has to run. A store should confirm the exact obligations that apply to it with a legal adviser. In build terms, a typical store needs the following pages, each linked from the footer on every page, not hidden three clicks deep.

The grievance officer. The Rules call for a named grievance officer and for complaints to be acknowledged within 48 hours and resolved within one month of receipt. Show the officer's name, designation and contact details on the website, and set up a way to log complaints and give a reference number. A "support@" address without a named person behind it does not do this. In build terms this can be a simple form that creates a ticket and sends an acknowledgement email, plus a process behind it. Test it: submit a complaint, check that the acknowledgement arrives and that someone owns the reply.

Consistency matters more than length. The most common failure we see is a policy page that contradicts the checkout: the returns page promises seven days while the product page says ten, or shipping times differ between pages. Pick one set of facts, and have the policy pages be the source that other pages quote.

Product information. Listing pages should give accurate details about what is being sold, including price, and for packaged goods the declarations that the Legal Metrology rules require, such as net quantity and the maximum retail price where applicable. Rules for e-commerce listings in this area have been amended recently, and the requirements differ by product category. TODO: verify with your CA or a compliance adviser what applies to your products, and see our guide on legal metrology requirements for product pages.

3. Honest price display and checkout design

India's consumer authority has issued guidelines against "dark patterns", which include deceptive interface practices such as adding charges late in checkout. For the website, the practical rules are simple and mostly common sense:

• Show the full price before the final step. If the customer sees ₹999 on the product page and ₹1,148 at payment because of shipping, handling and other fees, you have a problem both commercially and, potentially, legally. Show taxes, shipping and any fee as early as you can, and at least before payment.
• No pre-ticked extras. Do not add insurance, gift wrap or donations by default.
• No false urgency. Countdown timers or "only 2 left" messages must reflect reality.
• Make cancellation and unsubscribe as easy as sign-up.
• Keep reviews genuine. Do not publish fabricated reviews or hide all negative ones.

We cover this in more detail in our guide on dark patterns and checkout design, and on the pricing structure in consumer protection rules for stores. For the interaction between tax display and checkout flow, see our guide to checkout optimisation.

4. Payment and customer data

Card data. Your store should never store full card numbers, expiry dates or CVV on its own servers. Since 1 October 2022, the Reserve Bank of India's card-on-file tokenisation rules have prohibited merchants and payment aggregators from storing actual card details; saved cards work through tokens issued under the network framework. For a small or mid-sized store, the realistic route is a hosted or SDK-based checkout from a payment gateway that handles card entry on its side, so the card number never touches your server. Saved-card and one-click features then use gateway tokens. Our guide to adding a payment gateway to your store and the note on PCI DSS for stores explain what to build and what the gateway carries.

Personal data. The Digital Personal Data Protection Act, 2023 and the rules made under it, notified in 2025, are being phased in. For a store, the build implications are an accurate privacy notice, a clear consent step where consent is the basis for processing (marketing messages, for example), a way for customers to ask for correction or deletion, sensible retention of order data, and care with the vendors who process it. TODO: verify with a legal adviser which obligations apply to your business now and the dates for those that are still phased in. Our DPDP website compliance guide goes through the website-side tasks.

Basic security. HTTPS across the entire site, up-to-date platform and plugins, two-factor login for administrators, and removal of old staff accounts. See our guides on admin users and two-factor login and the website security audit for small businesses.

5. If you also sell on marketplaces

Selling through Amazon, Flipkart or similar adds obligations that mostly fall on the marketplace and your accountant, including tax collected at source by the marketplace, which was reduced to 0.5 percent of the net value of taxable supplies from July 2024 under the GST rules. TODO: verify the current rate and your treatment with your CA. The website implication is limited but real: keep marketplace orders and own-website orders distinguishable in your order and accounting data, so reconciliation does not mix two different treatments.

The compliance build checklist

Print this, hand it to your developer, and have your CA initial the rows that depend on their decisions.

Testing before launch

Run these test orders and keep the evidence:

1. Same-state order: invoice shows CGST and SGST.
2. Other-state order: invoice shows IGST.
3. Order with a discount code: taxable value reflects the discount.
4. Mixed-rate cart: each line shows its own rate and the totals add up.
5. Cancelled order: a credit note exists and the numbering has no gap.
6. Return and refund: the credit note and refund amounts match.
7. Policy pages: every footer link works on mobile, and the policies match the checkout.
8. Grievance form: acknowledgement email is received.
9. Card payment: the card form is served by the gateway, and nothing card-related appears in your logs or database.

Frequently Asked Questions

What must a GST invoice for an online store include?

Typically the supplier's name, address and GSTIN, a unique sequential number, date, buyer details, item descriptions with HSN codes, taxable value, the tax rate and amount split as CGST plus SGST or IGST, place of supply and total. Exact requirements depend on your turnover and type of supply, so confirm with your CA.

Does my online store need a grievance officer?

The Consumer Protection (E-Commerce) Rules, 2020 call for e-commerce entities to name a grievance officer, acknowledge complaints within 48 hours and resolve them within a month. Check how the Rules apply to your business with a legal adviser, and publish the officer's details on your site.

Can my website store customers' card details?

No. RBI's tokenisation rules, in force since October 2022, prohibit merchants and payment aggregators from storing actual card details. Use a hosted or SDK-based checkout from a payment gateway so card data never reaches your servers.

Is e-invoicing compulsory for every online seller?

No. It applies above a turnover threshold, which has been ₹5 crore of annual aggregate turnover in recent years, and mostly concerns business-to-business invoices. Ask your CA whether it applies to you, because thresholds have changed before.

Who is responsible for GST compliance, the developer or the accountant?

Your accountant decides the tax treatment and files returns. The developer builds the fields, calculations, documents and pages that carry out those decisions. Give your developer a written brief from your CA before the build.

Sources

• GST portal (gst.gov.in) and CBIC notifications, for invoice contents, e-invoicing thresholds and TCS rates; verify current figures with your CA.
• Consumer Protection (E-Commerce) Rules, 2020, notified under the Consumer Protection Act, 2019, for the grievance officer and complaint timelines.
• Central Consumer Protection Authority, Guidelines for Prevention and Regulation of Dark Patterns, 2023.
• Reserve Bank of India, card-on-file tokenisation framework, effective 1 October 2022.
• Digital Personal Data Protection Act, 2023 and the rules notified in 2025; check current phase dates with a legal adviser.
• The build checklist and test list are our own working guidance and are not a statutory list.

About the author and next step

This guide was written by the ecommerce team at Govindani Infotech, a website design and development company at 2nd Floor, Landmark Plaza, 206 Satara Road, Parvati Paytha, Pune 411009. We build the checkout, invoice templates and policy pages described above, but we do not give tax or legal advice. See our ecommerce development service, checkout system service and payment gateway integration pages, or contact the team on 092019 58274. Scope and pricing are confirmed after reviewing your store.