GST, Invoicing & Legal Compliance for Ecommerce Websites in India: A 2026 Checklist

GST, Invoicing & Legal Compliance for Ecommerce Websites in India: A 2026 Checklist

Most online sellers in India find out about GST, invoicing and consumer-protection rules the hard way — a notice from the GST department, a marketplace account frozen over a missing HSN code, or a customer complaint escalated to the National Consumer Helpline because the return policy wasn't displayed anywhere on the site. None of this is exotic law. It's a fixed set of requirements that apply to almost every business selling online in India in 2026: register for GST correctly, issue invoices with the right fields, collect and remit tax at source where it applies, and display the disclosures the Consumer Protection (E-Commerce) Rules require. What changes from business to business is only the detail — which threshold applies, whether TCS applies, which state you need to register in. This article works through each of those pieces at the level a website and checkout system needs to support them, and flags the exact points where you should get a five-minute confirmation from a chartered accountant before you build anything on top of an assumption.

A necessary disclaimer up front: Govindani Infotech is a website design and development company. We build the checkout pages, invoice templates and policy pages an ecommerce site needs — we are not chartered accountants and this is not tax or legal advice. GST rates, thresholds and e-invoicing rules are amended by CBIC notifications multiple times a year, and the Consumer Protection (E-Commerce) Rules have draft amendments in circulation as of 2026 that are not yet final. Every figure below reflects our research at the time of writing; anywhere the rule is genuinely unsettled or turnover-dependent, we've marked it TODO: verify with your CA rather than state it as fixed fact. Confirm current numbers on the GST portal or with your chartered accountant before you register, price, or file anything based on this article.

Why this matters for the website, not just the accountant

A CA can tell you whether you owe GST. Your website has to actually do the things that make you compliant — generate an invoice with the right fields, apply the right tax treatment depending on where the buyer is, collect TCS if you're a marketplace, and show the policy pages a regulator or customer can point to. Retrofitting this after launch usually means rebuilding order and invoice logic, not just adding a page — which is the reason to read this before launch, not after your first GST notice.

GST Registration Basics for Online Sellers

The general GST registration threshold for a business selling goods is ₹40 lakh in annual turnover (₹20 lakh for services, and ₹20 lakh / ₹10 lakh respectively in special category states like the North-Eastern states, Himachal Pradesh, Uttarakhand). Most first-time founders assume that threshold protects them until they cross it. For online sellers, it usually doesn't, for two separate reasons.

Selling through a marketplace (Amazon, Flipkart, Meesho, Myntra, etc.). Under Section 24 of the CGST Act, a supplier making taxable supplies of goods through an e-commerce operator that is required to collect TCS must register for GST regardless of turnover — there is no exemption for a seller doing ₹2 lakh a year on Amazon. This has been the settled position for goods since GST began. There have been periodic government notifications easing this for very small sellers of services through notified platforms, and the exact current carve-outs differ by whether you sell goods or services and which platform you use. TODO: verify with your CA which exemption, if any, applies to your specific product category before assuming you're exempt just because your turnover is small.

Selling only through your own website. If you sell exclusively through your own domain — not through a marketplace acting as an "e-commerce operator" under GST — the normal threshold generally does apply, but only as long as every sale is intra-state (buyer and seller in the same state). The moment you ship to a customer in a different state, GST registration becomes mandatory regardless of turnover, because inter-state taxable supply triggers Section 24 registration on its own. In practice, almost every online store sells pan-India within its first few orders, so almost every real ecommerce website ends up needing GST registration early, own-site or not.

A second trigger that catches sellers off guard: place of business, not just place of sale. GST registration is required in every state where you have a fixed place of business — a warehouse, an office, or a fulfillment/storage arrangement, including a marketplace fulfillment centre (e.g., FBA-style storage), if it creates a place of business for you in that state. That's different from merely shipping to a state, which does not by itself require registration there. Confirm with your CA whether your specific fulfillment arrangement counts.

Practical takeaway for a website launch: if you plan to ship outside your home state (nearly everyone does) or sell through any marketplace, budget for GST registration as part of your pre-launch checklist rather than something to defer until revenue justifies it — it affects how your checkout must calculate tax from day one.

E-Invoicing: What Your Checkout and Invoicing System Actually Need to Generate

"E-invoicing" specifically means reporting an invoice to the government's Invoice Registration Portal (IRP) to get an Invoice Reference Number (IRN) and QR code, before or immediately after it's issued. It is not the same as simply emailing a PDF invoice to a customer — a huge number of small sellers conflate the two and assume any auto-generated invoice satisfies the requirement.

As of 2026, e-invoicing is mandatory for any business whose Annual Aggregate Turnover (AATO) has crossed ₹5 crore in any financial year since 2017-18 — and once crossed, the obligation stays even if turnover later drops below ₹5 crore. This applies to B2B, export and deemed-export invoices; standard consumer-facing B2C retail invoices are generally outside the IRN requirement, though a separate, higher-turnover rule requires a dynamic QR code on B2C invoices for large businesses. TODO: verify with your CA the exact current AATO threshold for that B2C dynamic-QR requirement — it has moved before. GSTN also tightened the reporting window in a November 2024 advisory, requiring e-invoices to reach the IRP within 30 days for taxpayers above a higher AATO band; whether that 30-day rule currently applies to you depends on exactly where your turnover sits, so confirm rather than assume.

If you're below the e-invoicing threshold, you still need to issue GST-compliant tax invoices — the IRN is an additional government-reporting step on top of a properly formatted invoice, not a replacement for one. A GST tax invoice, whether or not it needs an IRN, has to show:

• Your legal business name, address and GSTIN, clearly printed, not buried in fine print
• A sequential, unique invoice number for the financial year
• Invoice date
• Customer's name, billing/shipping address, and GSTIN if the customer is a registered business (for B2B sales)
• HSN code for each item — 4 digits minimum for B2B invoices if your AATO is up to ₹5 crore, and 6 digits for all invoices (B2B and B2C) once your AATO exceeds ₹5 crore
• Taxable value, tax rate, and a clear tax breakup: CGST + SGST for intra-state sales, IGST for inter-state sales — shown as separate line items, not a single bundled "tax" figure
• Place of supply (particularly important for inter-state sales)
• Total invoice value in figures, and in words where required for higher-value invoices

For a website's checkout and order-management system, this translates into concrete build requirements, not accounting theory:

1. HSN codes attached at the product/SKU level, not typed in manually per order — someone has to maintain this in the product catalogue, and it needs to be correct at the digit-count your turnover requires.
2. Automatic CGST/SGST vs. IGST logic based on comparing the seller's registered state to the shipping address's state — this can't be a flat tax percentage applied the same way to every order.
3. Sequential invoice numbering that can't be skipped, edited, or reused, because GST audits specifically check for numbering gaps.
4. A generated PDF invoice per order, automatically, at the point of sale or dispatch — not a manually created invoice that someone has to remember to send.
5. If you're above the e-invoicing threshold, an API integration to the IRP (directly, or through your accounting software like Zoho Books, Tally, or a GST-suite plugin) so the IRN and QR code get embedded on the invoice automatically rather than as a manual monthly batch job.

None of this is exotic to build, but it has to be designed into the checkout and order flow from the start — see our related piece on ecommerce checkout optimization for how tax calculation interacts with checkout speed.

TCS: Marketplace vs. Your Own Website

Tax Collected at Source under GST Section 52 is one of the most commonly misunderstood pieces of ecommerce compliance, mainly because it only applies in one specific scenario: when an e-commerce operator collects payment on behalf of sellers using its platform.

If you sell through Amazon, Flipkart, Meesho, or a similar marketplace, the marketplace itself is the "e-commerce operator" and is legally required to deduct TCS at 0.5% of the net value of taxable supplies (0.25% CGST + 0.25% SGST intra-state, or 0.5% IGST inter-state) before paying you out. This rate was reduced from 1% to 0.5% effective 10 July 2024 and, as far as our research shows, remains at 0.5% in 2026 — TODO: verify the current rate with your CA, since TCS rates have been revised before. The marketplace remits this and files GSTR-8; you claim the amount collected as credit against your own GST liability when filing. Net value means sales minus returns and cancellations — TCS is not charged on the gross transaction amount.

If you sell only through your own website, this entire mechanism doesn't apply, because you are the seller, not an "operator" collecting on behalf of other sellers. You simply charge output GST on your invoices in the normal way and pay it through your regular GST returns — there's no TCS deduction to reconcile.

This distinction matters for a hybrid seller running both channels at once: your order and accounting logic needs to keep marketplace-channel orders (with TCS credit to track against GSTR-8 filed by the marketplace) separate from direct-website orders (straightforward GST liability, no TCS). A checkout and backend that mixes the two into one undifferentiated sales ledger creates real reconciliation problems at filing time.

State-Wise GST Considerations for Shipping Across India

Because GST is a destination-based tax, a single GST registration in your home state is generally enough to sell and ship to customers anywhere in India — you charge IGST on the inter-state sale, and no additional state registration is required purely because of where your customer lives. This surprises a lot of new sellers who assume "shipping to 20 states" means "20 GST registrations." It doesn't, as long as your only presence in those states is the delivery address on the parcel.

What does require registration in another state is having a place of business there — a warehouse, a fulfillment centre, an office, or storage arrangement that constitutes a fixed establishment. This is the practical trap for sellers using marketplace fulfillment programs or third-party logistics warehouses across multiple states: if a warehouse in Karnataka is stocking your inventory for faster regional delivery, that can trigger a GST registration requirement in Karnataka even though your company is headquartered in Maharashtra. TODO: verify with your CA whether your specific 3PL or marketplace-fulfillment arrangement counts as a place of business in that state — the answer depends on the exact contractual and operational arrangement.

For a website's logistics integration, the practical implication is that your order-management system should tag which warehouse or fulfillment location a shipment actually ships from, not just the seller's registered address — because if you eventually operate from multiple states, invoices need to reflect the correct "place of supply," which can differ from your primary registered address. That's one more reason logistics and invoicing shouldn't be built as two unconnected systems — see our logistics integration work for how shipment origin, carrier selection and invoicing stay linked in one order record.

Consumer Protection (E-Commerce) Rules: What Your Site Must Display

Separately from GST, the Consumer Protection (E-Commerce) Rules, 2020 (under the Consumer Protection Act, 2019) impose disclosure obligations on every e-commerce entity — including a standalone brand's own website, not only large marketplaces. These are things a customer or regulator can directly check by visiting your site, which makes them some of the easiest compliance gaps to spot from the outside, and some of the easiest to fix.

The core requirements as they stand:

• A named grievance officer, with name, designation, and contact details (email, and typically a phone number) displayed on the website — not just a generic "support@" address with no named individual behind it.
• Grievance acknowledgement within 48 hours of a complaint being raised, and resolution within one month of receipt.
• Clear, accessible disclosure of: return policy, refund policy, exchange policy, warranty/guarantee terms, delivery and shipment timelines, who bears the cost of return shipping, and accepted payment modes.
• Total price transparency — the final payable amount shown as a single figure with a clear breakup (product price, shipping, taxes, any platform fee), not a price that changes unexpectedly at the final checkout step.
• A way for a customer to track the status of a complaint, typically via a ticket or reference number.

Separately, an amendment to the Legal Metrology (Packaged Commodities) Rules notified in February 2026 requires e-commerce entities selling imported products to provide a searchable, sortable country-of-origin filter in their listings — not just a mention on the product page, but a genuine filter a shopper can use to browse only domestic or only imported goods. It takes effect 1 July 2026 and applies specifically to imported packaged products; if you sell exclusively domestically sourced goods, it's unlikely to apply, but confirm against your actual sourcing. There are also draft amendments to the Consumer Protection (E-Commerce) Rules circulating in 2026 that would add roles like a Chief Compliance Officer and Resident Grievance Officer, modeled on IT intermediary rules — as of our research these remain proposals, not notified law. TODO: verify with your CA or a legal advisor whether these have been finalized by the time you're reading this.

For a website, all of this is a build-and-content task, not just a policy-writing task: a footer or dedicated legal-pages section with Terms & Conditions, Privacy Policy, Shipping & Returns Policy, and a Grievance / Contact page with a real named officer, linked from every page, not buried three clicks deep. If your current site doesn't have these as distinct, findable pages, that's a same-week fix, not a rebuild — worth doing before the country-of-origin filter and any finalized amendment adds a fresh deadline on top.

Data Privacy and Payment Data: What Your Checkout Should (and Shouldn't) Touch

The most important rule here is also the simplest: your website should never store customers' full card numbers, CVV, or expiry dates on your own servers. Since 1 October 2022, RBI's card-on-file tokenization mandate has prohibited merchants and payment aggregators from storing actual card details; only the card networks (Visa, Mastercard, RuPay, etc.) or the issuing bank can hold that data, and businesses can only store an encrypted "token" representing a saved card — and only if the merchant itself is PCI-DSS compliant, which most small and mid-sized ecommerce businesses are not and generally shouldn't try to become.

In practice this means your checkout should use a hosted or SDK-based integration with a PCI-DSS certified payment gateway (Razorpay, PayU, CCAvenue, Cashfree and similar are all certified) so the card entry form itself is served by the gateway, not your own site — the card number never touches your servers. This isn't just good practice; it's the only realistic way for a small or mid-sized business to accept cards without taking on a compliance burden (certification, annual audits) disproportionate to its size. "Save this card" and one-click repeat checkout are still possible — they're built on the token the gateway or network gives you, not on card data you hold yourself.

Beyond card data, good practice for customer data — order history, addresses, phone numbers, email — includes a clear Privacy Policy describing what's collected and why, HTTPS across the entire site, and reasonable access controls on your admin panel so staff turnover doesn't leave old logins with customer-data access. India's Digital Personal Data Protection Act, 2023 introduces broader consent and data-handling obligations beyond payment data, rolled out in phases. TODO: verify with your CA or legal advisor the current DPDP Act compliance timeline applicable to your business size before treating any specific date as final.

The Website Compliance Checklist

Pulling the above into what should actually exist on an ecommerce website, independent of the accounting side your CA handles:

This table is a build checklist for your website team, not a substitute for your CA's filing calendar — treat the two as separate but connected pieces of the same launch.

How We Build This In

At Govindani Infotech, our ecommerce builds and checkout system work are designed with these requirements in mind from the structural level, not bolted on afterward. That means product catalogues with an HSN field built into the schema rather than a spreadsheet workaround, tax logic that compares seller and shipping state automatically instead of applying one flat rate, and order confirmation flows that generate a sequentially numbered, correctly formatted invoice PDF the moment an order is placed — with GSTIN, tax breakup and HSN codes populated from the product and business data already in the system.

On the payment gateway side, our integrations use the hosted or SDK checkout flows of PCI-DSS certified gateways so your site never touches raw card data — the RBI tokenization requirement is handled at the integration-architecture level, not as an afterthought. And every ecommerce site we build ships with the legal-page structure — Terms & Conditions, Privacy Policy, Returns & Refunds, and a genuinely findable Grievance/Contact page with a named contact — as a standard part of the build, not an optional extra a client has to remember to ask for.

What we don't do, and want to be upfront about, is tell you what GST registration type to choose, whether TCS applies to your specific sales mix, or when your Digital Personal Data Protection Act obligations kick in. That's genuinely a chartered accountant's or lawyer's call, made with your actual numbers and product categories in front of them — this article, and our build process, exist to make sure your website is technically ready to comply once your CA tells you what "compliant" means for your specific business.

If you're planning an ecommerce launch and want the technical side — invoicing, checkout tax logic, and policy pages — built correctly from day one, get in touch and we'll walk through what your specific catalogue and shipping footprint will need from the website.

Sources referenced in this article include CBIC e-invoicing notifications and GSTN advisories on the AATO threshold and HSN digit requirements, CGST/IGST notifications on the Section 52 TCS rate reduction effective July 2024, the Consumer Protection (E-Commerce) Rules, 2020 and reported 2026 draft amendments, the February 2026 Legal Metrology (Packaged Commodities) Rules amendment on country-of-origin filters, and RBI's card-on-file tokenization framework in effect since October 2022. Given how frequently these are amended, always cross-check current figures on the GST portal or with your CA before acting on them.