India's regulatory reset: what has changed for businesses in the past year
New labour codes, data protection rules and the second Jan Vishwas law have changed how companies must comply. The direction is towards trust and simpler rules, but the transition demands attention.
In 35 years of public service I saw both sides of regulation: rules that protected workers, consumers and the public, and rules that had outlived their purpose but still carried a threat of prosecution. The past year has brought one of the larger clean-ups of the regulatory system in recent memory.
Three changes that matter most
The labour codes. The four labour codes, covering wages, industrial relations, social security and occupational safety, came into force on 21 November 2025. They replaced 29 older central laws. Companies now work with a single definition of wages, new rules on fixed-term employment, and wider social security, including for gig and platform workers. Most firms are still adjusting payroll, contracts and policies to match.
Data protection. The Digital Personal Data Protection Rules were notified in November 2025, putting India's 2023 data protection law into effect in phases. Businesses that collect personal data must get clear consent, protect the data, report breaches and respond to people's requests about their information. For most companies the main obligations arrive over 2026 and 2027, which leaves limited time to prepare.
Jan Vishwas 2.0. The second Jan Vishwas law, passed in 2026, removes or reduces criminal penalties for hundreds of minor and procedural offences across 79 central laws. Prison terms for technical lapses are replaced with graded civil penalties decided by adjudicating officers, and some minor lapses can be met with an administrative warning.
What it adds up to
Together, these changes move India towards a system built on trust: fewer criminal threats for paperwork mistakes, clearer rules, and penalties that match the harm. That is good for enterprise, especially for small firms that could not afford to fight long cases.
But a simpler system is not a lighter one. Civil penalties are easier to impose than criminal ones, and data protection brings new duties that did not exist before. Companies that treat these reforms as a relaxation may find themselves exposed.
A short checklist for boards
- Ask management for a written gap analysis against the labour codes and the data protection rules
- Name an owner for data protection, with a reporting line to the board
- Review contracts with vendors who handle your customers' or employees' data
- Track which old offences now carry civil penalties, and update internal compliance manuals
- Watch for state rules under the labour codes, which vary and are still being notified
Good regulation is not measured by how many rules there are, but by whether people understand and follow them. The reforms of the past year are a real step in that direction. The next step is for companies and regulators alike to make them work in practice.