If you are staffing a dev team in Hyderabad or Bangalore, compliance is not a side issue, it is the thing that determines whether your offshore engagement runs smoothly or turns into a payroll and data-handling headache six months in. This piece breaks down the four areas that come up most often with US companies building India software development teams: EPFO retirement contributions, state registration and Professional Tax, the Digital Personal Data Protection Act, and where the industry itself is heading per NASSCOM’s 2026 review. We also covered the general compliance basics, including a lighter look at EPFO and DPDP, in our India staffing agency vs. traditional staffing comparison. This article goes deeper and stays focused specifically on IT and dev outstaffing. If you are also pricing out the engagement or comparing cities, our upcoming India software developer staffing pricing guide and Hyderabad vs. Bangalore city comparison round out the picture alongside this one.

EPFO Employer Contributions Explained

Every Indian employer with 20 or more employees, which covers essentially every outstaffing arrangement of meaningful size, must register with the Employees’ Provident Fund Organisation and make monthly contributions on behalf of each employee. The employer side is 12% of basic salary plus dearness allowance. That 12% is not a single pool, it splits into 8.33% routed to the Employees’ Pension Scheme (EPS), capped at the statutory wage ceiling, and the remaining 3.67% credited to the employee’s EPF account, according to Mercans’ 2026 EPF contribution guide. On top of that 12%, employers typically carry an additional 0.5% for Employees’ Deposit Linked Insurance (EDLI) and roughly 0.5% in EPFO administrative charges, so the real employer-side cost runs closer to 13% of basic plus DA once those riders are included.

Employees contribute their own matching 12% directly into their EPF account, meaning the combined monthly credit to an employee’s EPF savings is 15.67% of basic plus DA (the employee’s 12% plus the employer’s 3.67% EPF share). If a staffing partner quotes you a fully loaded cost per developer, EPFO contributions should already be baked into that number. If they are not, ask why, because this is not optional and it is not small.

Shops and Establishments Act and Professional Tax

Before an employer can legally operate in either state, the Hyderabad or Bangalore office needs to be registered under the respective state’s Shops and Establishments Act. In Telangana, registration must happen within 30 days of commencing operations, costs between Rs 200 and Rs 2,500 depending on headcount, and has to be renewed by December 1 every year, per Futurex Solutions’ Telangana Shops and Establishment Act guide. Karnataka applies a similar 30-day registration window with fees from Rs 150 to Rs 1,500, but since a 2019 amendment, Karnataka registration is permanent and does not need annual renewal, according to IncorpX’s state-wise Shop and Establishment registration guide. Each physical office location requires its own separate registration in both states, so a company running parallel teams in Hyderabad and Bangalore is handling two distinct filings, not one.

Professional Tax (PT) is a smaller line item but still a compliance requirement that trips up companies new to India payroll. Karnataka levies Rs 200 per month on employees earning a monthly gross salary of Rs 25,000 or more, as confirmed by BankBazaar’s Karnataka Professional Tax breakdown. Telangana uses a tiered structure: nil for salaries up to Rs 15,000, Rs 150 for Rs 15,000 to Rs 20,000, and Rs 200 above Rs 20,000, with new IT professionals getting a five-year PT exemption under certain conditions, per SalaryBox’s Telangana Professional Tax guide. The constitutional ceiling on Professional Tax nationwide is Rs 2,500 per year, which is why Karnataka’s monthly deduction bumps to Rs 300 in February to land exactly on that cap.

None of these numbers are large relative to total compensation, but missing a Shops Act renewal deadline or misclassifying a PT slab is the kind of small administrative miss that creates real friction with state labor inspectors later. A staffing partner that has already handled this for dozens of clients should be able to confirm current registration status without you having to chase it down yourself.

The DPDP Act and Your Offshore Dev Team’s Data

If your India-based developers are touching customer data, source code with embedded credentials, or any personal data your company processes, the Digital Personal Data Protection Act, 2023 (DPDP Act) is now directly relevant to how that data has to be handled. The Act itself passed in August 2023, but it stayed largely dormant until the Ministry of Electronics and Information Technology (MeitY) formally notified the Digital Personal Data Protection Rules, 2025 via gazette notification G.S.R. 846(E) on November 13, 2025, according to MeitY’s official notification. That notification started the clock on a phased rollout rather than flipping every provision on at once.

As of now, the Data Protection Board and the Act’s core definitions are already in force. Consent-manager provisions take effect roughly 12 months after notification, around November 2026, and the full set of substantive obligations, covering things like breach notification timelines and data fiduciary duties, becomes enforceable 18 months out, by May 13, 2027. A few of the most consequential pieces for outsourcing specifically, cross-border data transfer restrictions and Significant Data Fiduciary designations, are still pending separate government notification and have not been finalized yet, as detailed in Mondaq’s 2026 DPDP compliance analysis.

What this means practically for a US company with an India-based dev team: your staffing partner’s office should already be building DPDP-aligned practices into onboarding, things like access controls on client data, device and credential management, and written data handling policies, even while the enforcement timeline is still phasing in. Waiting until May 2027 to ask about this is waiting too long. Ask now what access controls and data handling policies are in place for any developer touching your systems, and ask how your partner plans to handle cross-border transfer requirements once those rules are finalized. This is general awareness, not a compliance audit, and you should have your own counsel review anything that touches regulated or sensitive data categories.

NASSCOM 2026: AI-Augmented, Hybrid Delivery

NASSCOM’s flagship 2026 Strategic Review, titled “Steering Through the Tides of Uncertainty,” projects India’s tech industry revenue at $315 billion for FY26, up 6.1% from a revised FY25 figure of $297 billion, according to the NASSCOM Strategic Review 2026 Executive Summary. Two trends from that report are directly relevant to anyone evaluating an India outstaffing arrangement right now.

First, AI is positioned as a core delivery layer rather than a bolt-on tool. NASSCOM’s report points to AI-assisted code generation, automated test authoring, predictive monitoring, and AI-driven service desks becoming standard parts of how India-based dev teams work, with the industry shifting toward what the report calls “Human + AI” delivery models. Global Capability Centers (GCCs) alone reported roughly 2.3% net employee growth with more than 2 million professionals upskilled in AI, including 200,000 to 300,000 in advanced AI skills. For a company evaluating a dev staffing partner, this is worth a direct question: what does AI-assisted development actually look like on your team, and is it reviewed by a human before it ships.

Second, hybrid delivery models that blend offshore teams with nearshore or onshore coordination are becoming the practical middle ground rather than the exception. NASSCOM frames this as balancing cost efficiency with the collaboration depth that complex projects require, which tracks with what we see directly: companies increasingly want an India-based core team paired with lighter onshore or nearshore project management rather than a fully offshore black box. If you are weighing Hyderabad against Bangalore for where to build that team, this hybrid shift is part of the decision, not just raw talent availability.

Common Questions