A few years ago, a due diligence checklist for an Indian D2C brand covered the usual ground: unit economics, inventory, GST filings, founder cap table. Data protection compliance was rarely a named line item because the law behind it did not exist in enforceable form yet. That is changing, slowly and unevenly, as the DPDP Act moves from a passed statute toward a fully operative one.
Why this is starting to show up
The Digital Personal Data Protection Act, 2023 is not new, but its obligations are becoming more concrete as implementation progresses, and full Section 33 exposure, the point at which financial penalties under the Act become enforceable against stores that have not acted, begins 13 May 2027. Investors and their diligence teams tend to look ahead of enforcement dates rather than wait for them, because a liability that becomes live during the holding period of an investment is exactly the kind of thing a term sheet or a warranty clause is meant to catch in advance.
For a D2C brand, the underlying question diligence teams are starting to ask is simple: do you know where your customers' personal data goes, have you told them, and can you show it. That question does not require a lawyer to answer well, but it does require the brand to have actually done the work rather than assumed it was someone else's job.
What this looks like in practice
Founders who have been through a recent raise or a marketplace onboarding process report a version of this question appearing in forms and calls more often than it used to: a line about privacy policy, a line about data handling practices, sometimes a direct question about whether the company has a documented list of the third-party tools it shares customer data with. None of this is a formal audit yet for most brands at seed or Series A stage. It is closer to a checkbox that is starting to appear next to the financial and legal ones, the way GST registration or basic contract hygiene already does.
The practical risk is not that a brand gets disqualified from a round over this today. It is that an unanswered or badly answered question slows a process down, or becomes a line item in a warranties and indemnities discussion where the founder is suddenly negotiating around a gap that would have taken an afternoon to close months earlier.
What a founder can actually show
The useful artefact here is not a legal opinion. It is a short, factual answer to three things: which third-party tools does the store send customer data to, what does the store's privacy notice say about that, and can the store show that shoppers were asked for consent rather than just shown a notice. A hypothetical example: a founder who can say "our Shopify store runs Meta Pixel, Klaviyo, and a WhatsApp BSP, our privacy notice names all three, and we log every shopper's consent on the storefront" has answered the question completely, in two sentences, without a single legal term.
Founders who cannot answer that today are not unusual. Most Indian D2C stores have not done this work yet, mostly because nobody broke it down into something a single ops person could execute without hiring counsel. That is changing as the question starts appearing more often on the other side of the table.
Consent Jet exists to make that two-sentence answer true rather than aspirational: it scans a store's actual processors, builds the privacy notice around what it finds, and keeps a logged record of shopper consent that a founder can point to directly when the question comes up.