Why VCs Are Now Asking About DPDP Compliance Before They Sign the Term Sheet

Until recently, a founder pitching a Series A round in India could get through due diligence without a single question about data protection. That is changing fast. Reports this month, including coverage in ET Entrepreneur on India's startup ecosystem, describe privacy compliance as an emerging risk factor in venture due diligence, with investors treating DPDP Act readiness as a signal of how seriously a founding team takes operational discipline. For anyone building a company that touches Indian user data, DPDP compliance has quietly moved from a legal to-do list item to a fundraising checkpoint.

This is not a hypothetical concern for a handful of large fintechs. It applies to any startup, at any stage, that collects personal data from Indian users, whether through a sign-up form, a payments flow, or a WhatsApp chatbot.

Why DPDP compliance is showing up in term sheets

Venture and private equity investors run legal and technical diligence before every meaningful check they write. Historically, that diligence covered cap tables, IP ownership, employment contracts, and tax exposure. Data governance is now part of the same checklist, for three practical reasons.

First, the penalties are large enough to matter at a cap table level. The DPDP Act allows fines of up to ₹250 crore per instance for failures such as inadequate security safeguards, and up to ₹200 crore for failing to notify a breach. A single enforcement action of that size can wipe out a meaningful share of a Series A round's post-money valuation, which is exactly the kind of tail risk a VC's investment committee is trained to flag.

Second, investors increasingly sit on the boards of companies that already had to build this compliance the hard way, and they have learned that retrofitting consent flows, vendor contracts, and data retention rules after a product has scaled is far more expensive than building it in from day one. A startup that shows up to diligence with an ad hoc "privacy@" inbox and no data map is telling investors that a rebuild is coming.

Third, many of India's fastest-growing sectors for venture funding right now, including fintech, healthtech, and edtech, process the exact categories of personal data the DPDP Act treats most seriously: financial information, health data, and children's data. These are also sectors where a regulator or a customer enterprise is likely to ask hard questions before the next funding round closes.

There is no small-company carve-out, at least not yet

Founders sometimes assume that a young or small company falls outside the DPDP Act's reach. It doesn't, and the Act's own text confirms this. Section 17(3) does give the central government the power to notify a lighter compliance track for a defined class of data fiduciaries, including DPIIT-recognised startups, exempting them from parts of the notice obligations and certain data-principal-rights and Significant Data Fiduciary provisions. As of now, though, the government has not issued that startup-specific notification. Until it does, a three-person, pre-revenue startup collecting user data carries the same core obligations as a listed enterprise: valid notice and consent, a way to honour data-principal requests, and reasonable security safeguards. Read our DPDP Act compliance guide for a fuller walkthrough of what those baseline obligations look like in practice.

What diligence teams actually look for

Investors and their counsel are not usually running a line-by-line audit against the Act during a fast-moving round. They tend to look for a handful of concrete signals that a founding team has treated data protection as infrastructure rather than an afterthought:

A privacy notice that actually describes what data is collected and why, rather than a template copied from a GDPR-facing competitor. Consent flows that separate a genuine opt-in for marketing from acceptance of the core terms of service, since bundled consent is one of the more visible dark-pattern issues under the Act. Data processing agreements with vendors and cloud providers, since a fiduciary carries full liability for a processor's failures under the DPDP framework. Some evidence of a data map showing what personal data the company holds, where it lives, and how long it is kept. And, for companies handling anything in the higher-risk categories, an early view on whether the business might eventually cross the threshold for classification as a Significant Data Fiduciary, which brings extra duties such as appointing a Data Protection Officer and running periodic audits. Our Data Protection Officer services and privacy impact assessment work are both built around getting that evidence in place before a diligence request lands in the inbox, not after.

Building compliance that survives a term sheet, not just a deadline

The good news for founders is that fixing this does not require an enterprise-grade compliance department. A lean but genuine programme, built in the right order, holds up well under diligence: a clear privacy notice, layered and specific consent screens, a written data retention policy with actual deletion in place, signed data processing agreements with the vendors that touch personal data, and a documented process for handling access, correction, and erasure requests from users. None of this needs to be perfect on day one. What investors are checking for is evidence that the team understands its obligations and has a credible plan, not a finished 500-page compliance manual.

Waiting until the November 2026 enforcement milestones or a live term sheet to start this work is the riskier path. Diligence timelines are usually measured in weeks, and consent architecture or vendor contract renegotiation cannot be improvised on that schedule. Our DPDP compliance checklist is a reasonable starting point for founders who want to see where the gaps are before an investor's counsel does.

Privacy compliance was never going to stay a purely legal conversation for long in a market where venture funding drives so much of the growth story. For Indian startups, DPDP readiness now sits somewhere between a legal obligation and a business fundamental, closer to having clean financials or a defensible cap table than to a routine policy document. Treating it that way, early, is the more efficient path either way.

This article is general guidance, not legal advice. Every startup's data flows and risk profile are different, and specific compliance obligations should be confirmed with a qualified professional. If you'd like help assessing where your startup stands, get in touch with our team or start with our DPDP compliance checklist.