GST, OIDAR & BNSS Cyber Compliance for Foreign Digital Service Providers in India

Dinesh Tiwari & Associates • Legal Services

GST, OIDAR & BNSS Cyber Compliance for Foreign Digital Service Providers in India

GST, OIDAR & BNSS Cyber Compliance for Foreign Digital Service Providers in India

1. Executive Summary: Overseas Digital Services Regulatory Architecture

Foreign entities supplying digital services, cloud infrastructure, SaaS products, streaming media, or digital downloads to non-taxable online recipients (consumers) in India are subject to strict statutory oversight. Governed by the Integrated Goods and Services Tax (IGST) Act, 2017 and enforcement directives from the Central Board of Indirect Taxes and Customs (CBIC), overseas platforms must register under the Online Information Database Access and Retrieval (OIDAR) framework.

With the implementation of the Digital Personal Data Protection (DPDP) Act, 2023 and the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023, cross-border digital service compliance now encompasses tax remittance, data localization obligations, and digital evidence preservation for regulatory audits.

2. Statutory Definition of OIDAR Services

Under Section 2(17) of the IGST Act, OIDAR services are defined as services whose delivery is mediated by information technology over the internet or an electronic network and the nature of which renders their supply essentially automated and involving minimal human intervention. Key categories include:

  • Cloud computing, remote server hosting, SaaS, and PaaS solutions.
  • Digital content streaming (video, audio, OTT platforms) and digital gaming.
  • Online advertising feeds, automated data analytics, and search engine services.
  • E-books, software downloads, online subscriptions, and database access.

3. Mandatory GST Registration & Zero Threshold Exemption

Unlike domestic businesses benefiting from annual turnover exemption thresholds (тВ╣20 Lakhs / тВ╣40 Lakhs), foreign OIDAR providers operate under zero threshold exemption. If a single commercial or consumer transaction is made to a person in India who is not registered under GST (B2C customer):

  1. The overseas service provider is mandatory liable to pay 18% IGST on the gross transaction value.
  2. Application must be submitted online via Form GST REG-10 on the common GST portal.
  3. Failure to register empowers CBIC to initiate URL/IP blocking under Section 69A of the IT Act in coordination with MeitY.

4. Appointment of Local Representative & BNSS Digital Audit Compliance

Statutory Mandate: Authorized Indian Representative

Foreign OIDAR entities must appoint a person resident in India to act as their authorized representative for GST compliance. Under BNSS Section 61 and BSA Section 63, the local representative is legally custodian for producing electronic audit trails, server transaction logs, and GSTR-5A reconciliation statements during statutory tax audits or law enforcement inquiries.

5. Monthly Filings, Invoicing & Financial Penalties

Compliant OIDAR entities must adhere to strict operational timelines:

  • GSTR-5A Monthly Return: Mandatory tax filing due by the 20th of each succeeding calendar month.
  • Tax Remittance in INR: IGST collected in foreign currencies must be converted and remitted to authorized Reserve Bank of India (RBI) tax accounts in Indian Rupees.
  • Penalty Mechanisms: Non-filing attracts statutory interest at 18% per annum under Section 50 of CGST Act, coupled with mandatory penalty under Section 122 equal to 100% of tax evaded.

6. Frequently Asked Questions (OIDAR & Tax Compliance)

Q: Is GST registration required if an foreign SaaS vendor sells only to Indian businesses (B2B)?

A: If the Indian buyer is GST-registered, the transaction qualifies under Reverse Charge Mechanism (RCM) where the recipient pays GST. Registration under OIDAR (GST REG-10) is mandatory specifically for B2C supplies to non-taxable recipients.

Q: What digital records must be preserved for BNSS and GST audits?

A: Server access logs, IP geolocation records, Indian payment gateway confirmation receipts, and customer billing records must be preserved for a minimum of 72 months under GST audit rules.

7. Professional Consultation Services

Dinesh Prasad Tiwari & Associates acts as legal and tax counsel for international technology entities, coordinating OIDAR GST registrations, acting as statutory representatives, and managing CBIC audit defenses across India.