QR Code Rules in India: What Businesses Need to Know (2026)

The single most useful thing to understand is that QR codes are not separately regulated as a technology. They are a way of encoding information visually, and the rules that apply are whichever rules govern what you are doing.

Why this framing helps: It stops you searching for "QR code law," which does not meaningfully exist as a single thing, and points you toward the actual authority for your use case. If you know what your code does, you know which rule area to check.

A useful test: Ask what would be regulated if you did the same thing without a QR code. If you took payment by bank transfer, payment rules apply. If you collected customer details on a paper form, data protection applies. If you printed the information directly on the package, labelling rules apply. The QR code does not change the underlying obligation, it just changes the delivery format.

The one genuine QR-specific consideration: Accessibility and fallback. If information is legally required to be available, providing it only via QR code may not satisfy that requirement, since not everyone can scan. Providing the information in an accessible alternative form alongside the code is both good practice and often the safer compliance position. See our accessible QR codes guide.

Payment is the most regulated QR use case in India, which makes sense given UPI's scale.

What area this falls under: Payment system regulation, administered through the central banking and payment infrastructure authorities, with UPI operating under the national payments framework.

Interoperability is mandated, and that benefits you: UPI QR codes work across apps by design. A single QR accepts payment from any UPI app. You are not required, and should not need, to display separate codes per app.

Fees and charges: Fee structures for various transaction types have changed over time and are set by the applicable framework and your provider. Confirm current charges with your provider directly.

Your practical responsibilities: Use a proper merchant QR, keep your registration details accurate, reconcile your settlements, and protect your displayed code from tampering. The tampering point is a genuine merchant risk and is covered in detail in our UPI payments guide.

Where to verify: Your payment provider or bank for terms and fees, and the official payment authority publications for the framework itself.

The second clearly regulated use case is the QR code on tax invoices.

What area this falls under: GST rules, specifically the e-invoicing framework.

How it works in brief: Where e-invoicing applies, invoice details are reported to the government invoice registration system, which validates them and returns a digitally signed QR code that goes on the invoice. Its purpose is authenticity and verification.

Why this article does not give you a threshold: E-invoicing applicability thresholds in India have been revised repeatedly since the framework was introduced. Quoting a figure risks being wrong by the time you read this, and a business making a compliance decision on a stale number from a blog is exactly the failure mode worth avoiding. The official GST portal and your chartered accountant hold the current position.

Where to verify: The official GST portal, the e-invoicing system documentation, and your chartered accountant.

Covered in more depth in our GST-compliant QR invoices guide.

Three more areas that touch QR codes depending on what you are doing.

Product labelling and packaging Packaged goods in India are subject to declaration requirements covering things like manufacturer details, quantity, and pricing information, administered under consumer and metrology rules, with food products additionally subject to food safety requirements.

The QR-relevant question is whether a QR code can substitute for printed declarations. The safe general position is that mandatory declarations should be present in the required form, with a QR code used to provide additional or expanded information rather than to replace what must be printed. Requirements differ by product category, so confirm for yours.

Useful for: supplementary information such as sourcing detail, usage instructions, recycling guidance, and authenticity verification. See our product packaging guide.

Data protection If your QR code leads somewhere that collects personal information, whether a form, a signup, or an account, India's data protection framework applies to that collection.

Note that ordinary QR scan analytics are anonymous and aggregate, which is a different matter from collecting personal information. See our QR code privacy guide.

Advertising and consumer protection If a QR code is part of an advertisement or promotion, normal advertising standards apply to the claims made, both on the material carrying the code and on the destination page. A code cannot be used to bury terms that should be disclosed prominently. If the offer has material conditions, they need appropriate visibility, not just a link behind a scan.

Rather than a rulebook, here is a workable process for any QR code you deploy.

1. Ask what the code actually does. Payment, invoicing, labelling, data collection, advertising, or plain information. This determines everything else.

2. If it touches money or tax, use the official route. Payment QR from a proper merchant channel. Invoice QR from the e-invoicing system via your software. Do not improvise either.

3. If it collects personal data, treat the destination as the regulated thing. Disclose, minimize, secure, and put anything confidential behind authentication rather than behind an open code.

4. If information is legally required, do not make QR the only route to it. Provide an accessible alternative. Not everyone can scan, and a mandatory disclosure available only by scanning may not satisfy the requirement.

5. For plain marketing and information codes, ordinary rules apply. Truthful claims, clear terms, a working destination. Nothing QR-specific.

6. Verify current requirements at the source. The official portal for your area, and a qualified professional for decisions that matter. Rules change, and this article is intentionally a map rather than an authority.

7. Use dynamic codes for anything printed. Not a compliance requirement, but a practical one. Printed materials outlive URLs, and a dynamic code lets you fix a destination without a reprint. See dynamic vs static QR codes.

The honest summary: For most Indian businesses using QR codes for menus, reviews, WhatsApp, and marketing, there is very little regulatory complexity. The complexity concentrates in payments and tax invoicing, and in both cases the practical answer is to use the official channel and let your provider or software carry the compliance load.