The approvals map
Most approvals are routine but product-specific. A retailer needs the FDI approval (if any), GST registration and a Shops and Establishments registration for each store or office. Each product category then brings its own regulator: cosmetics go to CDSCO, food to FSSAI, pre-packed goods to Legal Metrology, and goods under a Quality Control Order to BIS. Online platforms and sellers answer to the CCPA under the E-Commerce Rules, and every business holding customer data is a data fiduciary under the DPDP Rules.
| Approval or registration | Authority and portal | When it is needed and typical time |
|---|---|---|
| Government approval: MBRT, food retail, land-border owners | DPIIT and the administrative ministry, through the FIF portal on NSWS | Before the investment. Proposals with land-border beneficial owners also go to the Ministry of External Affairs for comments. |
| GST registration | GST portal (central and state tax authorities) | Before the first sale. Since 1 November 2025, low-risk applicants can opt for automated registration within three working days. |
| Shops and establishments registration | State labour department, under the state Shops and Establishments Act | For stores and offices. Tamil Nadu lets establishments with 10 or more staff open 24×7 for three years from 5 June 2025. |
| Import registration for cosmetics | Central Drugs Standard Control Organisation (CDSCO) | Before import: apply in Form COS-1 for a Form COS-2 certificate. Fees USD 1,000 per cosmetics category, USD 500 per manufacturing site and USD 50 per variant; CDSCO targets 90 days. |
| Food safety | Food Safety and Standards Authority of India (FSSAI) | FSSAI sets food standards and regulates food safety; plan its clearances before importing or selling food, including through e-commerce. |
| Legal Metrology: pre-packed goods | Department of Consumer Affairs (Legal Metrology) | Packaged goods must carry the declarations the rules require. From 1 July 2026, under G.S.R. 128(E) of 13 February 2026, e-commerce entities selling imported goods must offer a searchable country-of-origin filter. |
| BIS certification under Quality Control Orders | Bureau of Indian Standards (BIS) | Products under a QCO need BIS certification before sale. QCOs on 14 polymer and fibre items were withdrawn from 12 November 2025. |
| E-Commerce Rules 2020 and dark-pattern guidelines 2023 | Central Consumer Protection Authority (CCPA) | Apply to online platforms and sellers. The guidelines list 13 dark patterns; in June 2026 CCPA fined two companies for pre-ticked consent and other dark patterns. |
| Digital Personal Data Protection Rules 2025 | Ministry of Electronics and Information Technology (MeitY) | Notified 13 November 2025 (G.S.R. 846(E)), with 18 months for phased compliance; each data fiduciary must issue a separate, clear consent notice. |
Timelines stated in the sources
| Step | Stated time | Authority |
|---|---|---|
| GST registration, low-risk applicants | Within three working days (automated option since 1 November 2025) | GST portal |
| Cosmetics import registration (COS-1 to COS-2) | CDSCO targets 90 days | CDSCO |
| Country-of-origin filter for imported goods sold online | Required from 1 July 2026 | Department of Consumer Affairs (Legal Metrology) |
| DPDP Rules compliance | 18-month phase-in from 13 November 2025 | MeitY |
| Marketplace statutory auditor’s report | By 30 September each year | Company’s statutory auditor (FDI Policy condition) |
| Tamil Nadu 24×7 trading for establishments with 10 or more staff | Three years from 5 June 2025 | Tamil Nadu labour department |
Government-route FDI approvals follow the DPIIT Standard Operating Procedure of 4 May 2026; the brochure states no fixed time for a retail or food-retail proposal. General approval timelines are covered under approvals and timelines.
Points by regulator
DPIIT and the FIF portal
Only three cases in this sector go to the Government route: multi-brand retail, retail of food made in India, and any investment with a land-border beneficial owner above 10% or with control. Applications are filed on the Foreign Investment Facilitation portal on NSWS.
CDSCO for cosmetics
Registration is per cosmetics category, per manufacturing site and per variant, and the fees are set in US dollars. Because the target is 90 days, the application should precede the first import by at least that long.
FSSAI for food
FSSAI clearances apply to food sold through e-commerce as well as in stores. For a brand retailing food made in India, the FDI approval and the FSSAI requirements run in parallel.
Legal Metrology
Pre-packed goods carry mandatory declarations. The 2026 amendment adds a platform duty: an e-commerce entity selling imported goods must let shoppers search and sort by country of origin from 1 July 2026.
BIS
Only products under a Quality Control Order need certification. The withdrawal of QCOs on 14 polymer and fibre items from 12 November 2025 removed that requirement for inputs such as polyester yarn and fibre.
CCPA
The 2023 guidelines list 13 dark patterns. The June 2026 enforcement against two companies for pre-ticked consent shows the rules are applied; the CCPA has also pointed to the 26 platforms that declared self-audit compliance in November 2025.
MeitY and the DPDP Rules
Retailers holding customer data are data fiduciaries. Compliance is phased over 18 months from 13 November 2025, and consent notices must be separate and clear.
What to check next
- List every product category you will sell and match each to its regulator before the first import order is placed.
- Start CDSCO registration early enough for the 90-day target to fall before launch.
- Register each store under the state Shops and Establishments Act, and check trading-hour rules state by state.
- Build the country-of-origin filter into the platform before 1 July 2026 if you sell imported packaged goods online.
- Schedule DPDP consent-notice work within the 18-month phase-in and review the platform against the 13 listed dark patterns.