DPDP Rules and Your Next Round: The Data Questions Investors Now Ask Consumer Brands Before the May 2027 Deadline
By the Alphamark Venture Partners teamPublished 22 October 20263 min read
India's data protection rules bite fully in May 2027 and investors are already pricing the risk. What the DPDP Rules require, the diligence questions consumer brands get, and a 90-day fix before you raise.
The short answer
The Digital Personal Data Protection Rules, 2025 were notified in November 2025 with an 18-month phase-in: the Data Protection Board is already in place, consent manager rules start in November 2026, and almost all operating duties (notices, consent, security safeguards, breach reporting, retention, children's data) apply from May 2027. Penalties run up to ₹250 Cr for failing to protect data and ₹200 Cr each for failing to report a breach or breaching children's data duties. Investors are already asking consumer brands for a data map, consent records for marketing lists, vendor contracts, access controls and a breach plan, and are writing specific indemnities and post-closing conditions into term sheets. A brand that fixes the basics before it raises avoids a diligence discount on the repeat revenue its lists produce.
Who this is for: Founders of D2C and consumer brands, consumer apps and services that hold customer data and plan to raise in the next 12 months, and founders who have received a data protection questionnaire in diligence.
Summary: what most founders miss
- The DPDP Rules were notified in November 2025. Most operating duties, including notice, consent, safeguards and breach reporting, apply from May 2027; consent manager rules start in November 2026.
- Penalties reach ₹250 Cr for inadequate security safeguards and ₹200 Cr each for failing to report a breach or breaching children's data duties.
- Every breach is reportable: an intimation without delay and a detailed report within 72 hours, alongside the separate six-hour CERT-In obligation.
- Investors now ask for a data map, consent records for WhatsApp, SMS and email lists, vendor contracts, access logs and a breach plan. Gaps show up as indemnities and conditions in the term sheet.
- For consumer brands the real risk is commercial: repeat revenue built on lists without clear consent gets discounted in diligence.
For most consumer brands, customer data is the asset behind repeat revenue: WhatsApp and SMS lists, email flows, retargeting audiences, loyalty programmes. Until recently, investors treated data protection as a boilerplate warranty. With India's Digital Personal Data Protection Rules notified and the main obligations arriving in May 2027, data has moved into the diligence questionnaire, and in some rounds into the price.
What applies when
| Phase | From | What starts |
|---|---|---|
| Immediate | November 2025 | Definitions and the Data Protection Board of India; complaints can be filed |
| 12 months | November 2026 | Registration and obligations of consent managers |
| 18 months | May 2027 | Notice, consent, security safeguards, breach reporting, retention and erasure, children's data, data principal rights, cross-border transfers |
Rules notified on 13 November 2025 and published in the Gazette on 14 November 2025. Timelines as summarised by PIB, EY and KPMG; check the exact commencement dates for any obligation you rely on.
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 Cr |
| Failure to notify the Board and affected people of a breach | ₹200 Cr |
| Breach of additional obligations for children's data | ₹200 Cr |
| Breach of Significant Data Fiduciary obligations | ₹150 Cr |
| Any other breach of the Act or Rules | ₹50 Cr |
Schedule to the Digital Personal Data Protection Act, 2023. Penalties are imposed per instance by the Data Protection Board after an inquiry.
The diligence questions consumer brands are getting now
| Question | A good answer | Common gap |
|---|---|---|
| What personal data do you hold, where, and why? | A one-page data map by system: store, CRM, WhatsApp, email, ads, logistics, support | Customer exports sitting in personal drives and agency folders |
| What is the basis for your marketing lists? | Opt-in captured at checkout or on WhatsApp, with timestamps, and an easy opt-out | Lists built from order data, contests or bought databases with no consent record |
| What notice do customers see? | A clear, itemised notice of what is collected and why, in plain language | A copied privacy policy that does not match actual practice |
| Who can access customer data? | Role-based access, removed when people or agencies leave, with logs | Agencies and former employees with admin access |
| What do your vendor contracts say? | Processing terms with every processor: purpose, security, breach notice, deletion | Click-through terms only, no review |
| What happens if you are breached? | A written plan covering CERT-In within six hours and the Board within 72 hours | No plan, no owner |
| Do you process children's data? | Verifiable parental consent where under-18 data is collected; no tracking or targeted ads at children | Baby and kids brands collecting a child's age or birth date without a consent mechanism |
Practitioner summary of questionnaires used in Indian consumer rounds in 2026.
How data gaps show up in the term sheet
- Warranties that the company complies with data protection law, with disclosures against them. Disclose gaps; an undisclosed gap becomes a breach of warranty.
- Specific indemnities for known pre-closing issues, often outside the general cap. Negotiate a cap, a time limit and a defined trigger.
- Conditions subsequent: a fixed list of fixes (notices, consent flows, vendor terms, a grievance contact) to be completed within 90 to 180 days of closing.
- Information rights: notice to investors of any breach or regulatory communication.
A 90-day fix before you raise
- Map the data: every system holding customer data, what is held, why, and who can access it.
- Fix capture: an itemised notice at checkout and sign-up, separate opt-ins for marketing, and timestamps stored with each consent.
- Re-notice existing lists. The Act requires people whose consent was taken before it commenced to be given a notice as soon as reasonably practicable; use that to re-confirm opt-ins and clean the list.
- Clean up access: remove former employees and agencies, move shared logins to named accounts, and stop customer exports to personal drives.
- Paper the processors: processing terms with your platform, CRM, messaging provider, logistics partners and agencies.
- Write a breach plan with an owner, covering the six-hour CERT-In report and the 72-hour report to the Data Protection Board, and keep processing logs.
- Set retention: delete data you no longer need for the purpose it was collected for, and publish a grievance contact.
Case study
The baby care brand that turned a data finding into a condition, not a discount
Baby and kids personal care brand, ₹30 Cr revenue, about 2.1 lakh customer records, about 40% of revenue from WhatsApp and email repeat orders
Situation
During Series A diligence, the lead's counsel sent a data protection questionnaire. The brand collected each child's birth month to time product reminders, and its WhatsApp list had grown from order data, festive contests and two influencer lead campaigns.
What was missed
There was no parental consent mechanism for the child's data, no consent record for about a third of the WhatsApp list, and two agencies and a former employee still had admin access to the store. The lead's model initially cut repeat revenue assumptions by a quarter.
What changed
Before signing, the founders shipped a parental consent step for the reminder feature, re-noticed the full list and removed about 28% who did not re-confirm, cleaned up access, and signed processing terms with five vendors. Remaining items went into the SHA as conditions subsequent within 120 days, with a capped specific indemnity for pre-closing issues.
Outcome
The repeat revenue haircut was removed from the model because the cleaned list showed higher engagement than the old one. The round closed at the originally discussed valuation.
The lesson
Investors price uncertainty, not imperfection. Showing a clean, smaller list with proof of consent is worth more than a large list nobody can vouch for.
Illustrative case. Figures are representative of patterns in Indian consumer rounds, not a specific company.
Related: Why good brands fail due diligence and the contribution margin math investors use. Preparing a data room for a consumer round? Talk to us.
Sources
Questions founders ask us
When do the DPDP Rules apply to my startup?
The Rules were notified in November 2025 with an 18-month phase-in. The Data Protection Board is already in place and consent manager rules start in November 2026, but the main duties on notice, consent, security safeguards, breach reporting, retention and children's data apply from May 2027.
Do the DPDP rules apply to small D2C brands?
Yes. The Act applies to any business processing digital personal data in India. The government can exempt notified classes, including startups, from some obligations, but no founder should plan on an exemption without checking a specific notification.
What are the penalties under the DPDP Act?
Up to ₹250 Cr for failing to take reasonable security safeguards, ₹200 Cr for failing to report a breach, ₹200 Cr for breaching children's data duties, ₹150 Cr for Significant Data Fiduciary breaches, and ₹50 Cr for other breaches, imposed per instance after an inquiry.
How quickly must a data breach be reported?
Under the DPDP Rules, an initial intimation to the Data Protection Board and affected people without delay, and a detailed report within 72 hours. CERT-In's separate rules require cyber incidents to be reported within six hours.
What about marketing lists built before the rules?
Where consent was obtained before the Act came into force, the Act requires the business to give a notice to those people as soon as reasonably practicable. Use it to re-confirm opt-ins; lists without any consent record are the main diligence risk.
How do investors check data protection compliance?
Through a diligence questionnaire covering the data map, notices, consent records, access controls, vendor contracts, children's data and breach history, followed by warranties, specific indemnities and post-closing conditions in the transaction documents.
About the author
Written by the Alphamark Venture Partners team, a fundraising advisory firm helping founders raise seed, angel and pre-Series A rounds, with a focus on consumer, consumer tech and consumer AI. Rules, figures and benchmarks are checked against the sources listed and are current as of the date shown. This is general information, not legal, tax or investment advice.
Raising in the next 6 months?
We typically work with brands doing ₹30L+ in monthly revenue raising ₹1 Cr to ₹15 Cr. Share your deck and numbers.
How our consumer and d2c brands support worksKeep reading
More from the fundraising guides
BlogDiligence & metrics · 4 min readRead article18 Aug 2026The Working Capital Trap: Why Consumer Brands With Great Margins Still Run Out of Cash Six Months After Raising
A brand growing from ₹50 lakh to ₹1.5 Cr a month can need ₹3 Cr or more just in inventory and receivables. Here is the math founders skip, why investors do not want equity funding it, and what to use instead.
BlogDiligence & metrics · 3 min readRead article7 Aug 2026What investors look for before writing a cheque
Beyond the deck: the numbers, documents and founder behaviour seed and pre-Series A investors check before they commit.
Blog
Investors & capital · 3 min readRead article22 Oct 2026SME IPO or Venture Capital? What SEBI's 2025 Rules and the October 2026 Proposal Mean for Profitable Consumer Brands
Profitable brands growing 20% a year often hear "good business, not a VC outcome". The SME IPO rules in force, SEBI's 14 October 2026 proposals, real costs, and how listing compares with a private round.