Statutory vs Regulatory vs Contractual Compliance

Three words get used interchangeably in Indian business, and they mean different things with different consequences: statutory, regulatory and contractual compliance.

The distinction is not academic. It decides who can penalise you, how much, and whether you can negotiate your way out of it. One of the three you can renegotiate. The other two you cannot.

Statutory compliance

Obligations created by an Act of Parliament or a state legislature. They apply because the law says so, and nobody signed anything to opt in.

For an Indian employer, the main ones now sit in the four Labour Codes, which came into force on 21 November 2025 and replaced twenty-nine older central Acts. Central rules followed on 8 May 2026, and state rules are still being notified.

Code on Wages, 2019 covers minimum wages, timely payment and bonus. It absorbed the Minimum Wages Act 1948, the Payment of Wages Act 1936, the Payment of Bonus Act 1965 and the Equal Remuneration Act 1976. Wages are due by the 7th of the following month, deductions are capped at 50%, and final settlement is due within two working days of an exit.
Code on Social Security, 2020 covers PF, ESI, gratuity and maternity benefit.
Industrial Relations Code, 2020 covers standing orders, discipline, retrenchment and disputes.
OSH and Working Conditions Code, 2020 covers hours, safety and contract labour.

Alongside them sit statutes the Codes did not touch: POSH 2013, the Rights of Persons with Disabilities Act 2016, and your state’s Shops and Establishments Act.

If your handbook still cites the Payment of Wages Act or the Factories Act as live obligations, it is quoting law that no longer exists.

Regulatory compliance

Rules made by a sector regulator rather than by the legislature. They bind you only if you operate in that sector, and they change far more often than statute does.

RBI directions for NBFCs, banks and payment companies
SEBI regulations for listed companies and market intermediaries
IRDAI rules for insurers and brokers
FSSAI for anything involving food

Data protection sits here for most companies. For an Indian employer the reference is the Digital Personal Data Protection Act, 2023. GDPR applies only if you process EU residents’ data, which is worth knowing because a lot of Indian HR content quotes GDPR by reflex.

Contractual compliance

Promises you made voluntarily. A client MSA, a vendor SLA, an employment contract, a lease.

This is the only one of the three you can renegotiate, and the one most likely to be breached without anyone noticing until a renewal. Common examples: a data-handling clause in a client contract that is stricter than the law requires, a notice period in an employment contract that nobody enforces consistently, or an uptime commitment nobody is measuring.

How they differ in practice

Statutory obligations apply to everyone and carry penalties set by law, sometimes personal liability for directors. Regulatory obligations apply only to your sector but change frequently and can cost you a licence. Contractual obligations apply only to the party you promised, and the remedy is usually damages or termination rather than a fine.

One practical consequence: you can be fully statutorily compliant and still lose a client for breaching a contract clause you never read.

Where companies get confused

Two patterns, both common.

A startup treats statutory as the whole picture and misses a sector rule that turns out to gate a licence. Or a larger company runs tight regulatory reporting and quietly under-files PF for a group of workers everyone treats as consultants, which is the single most common statutory exposure in Indian companies.

The other trap is state law. Professional tax, minimum wages and Shops and Establishments rules follow where the employee actually works, not where you are registered.

Keeping on top of all three

Keep one list, split into the three categories, with an owner and a date against each line. Statutory items are mostly monthly and annual. Regulatory items are whatever your regulator publishes. Contractual items should be pulled out of your contracts once and reviewed at renewal.

Review the statutory section annually at minimum. State rules under the Codes are still landing, and thresholds have already moved: standing orders and prior permission to retrench both went from 100 to 300 workers.

Which one to worry about first

Managing Compliance Is Complex: We Make It Simple

HRTailor handles all three types of compliance (statutory, regulatory, and contractual) for 100+ Indian companies. Never miss a filing or face a penalty again.

See Our Compliance Services →

Statutory, because it applies to you whatever you do and the penalties are not negotiable. Then whichever regulator can take your licence away. Contractual last, unless a big client renewal is coming.

We handle the statutory layer for companies between 10 and 300 employees, across every state they employ in. See what is covered, or send us your headcount and locations.

Quick comparison: statutory vs regulatory vs contractual

Aspect	Statutory	Regulatory	Contractual
Source	Acts of Parliament / state laws	Rules & circulars from regulators	Agreements you sign
Examples	EPF Act, ESI Act, Minimum Wages	EPFO circulars, RBI/SEBI directions	Employment contracts, NDAs, client SLAs
Consequence of breach	Interest, damages, penalties, prosecution	Fines, orders, licence action	Civil claims, damages, termination
Can you opt out?	No – applies by law	No – applies if regulated	Yes – negotiable before signing

Frequently asked questions

What is the difference between statutory and regulatory compliance?

Statutory compliance comes directly from laws passed by Parliament or state legislatures (such as the EPF Act or Minimum Wages Act), while regulatory compliance comes from rules issued by regulators and government bodies (such as EPFO circulars, RBI or SEBI directions) under the authority of those laws.

What is contractual compliance in HR?

Contractual compliance means honouring obligations a company voluntarily agreed to – employment contracts, offer letters, client agreements, NDAs and vendor contracts. Breach leads to civil claims and damages rather than statutory penalties.

Which type of compliance carries the highest risk?

Statutory non-compliance is usually the most serious for employers – it can attract interest, damages, penalties and even prosecution. Regulatory breaches bring fines and orders from the regulator, while contractual breaches lead to disputes and damages.

Do the new Labour Codes change statutory compliance?

Yes. The four Labour Codes consolidate and replace many earlier central labour laws, and states notify their own rules under them – so employers must track both the Codes and their state’s rules.

Who is responsible for compliance in a company?

The employer is legally responsible. In practice, responsibility is shared between HR, finance and leadership – or delegated to a compliance partner – but liability stays with the establishment and its officers.

Free download: PF & ESIC Registration Kit

Documents list, step-by-step checklist and a deadline calendar for employers.

Get the Free Kit →