Investor Data Room Checklist for Indian Startups

A data room is where an investor checks whether your story holds up. By the time you open it, the investor already likes the business. The room decides whether that liking survives legal, financial and tax due diligence, and how many conditions and indemnities end up in the final documents.

Build it before you need it. A room assembled in a hurry after a term sheet slows the close and signals weak controls. This checklist covers the folders an Indian startup should prepare, the problems diligence usually finds, and how to share sensitive data safely under the Digital Personal Data Protection Act, 2023.

Start with an index, then ten folders

Open the room with a short index that lists every folder, what is in it and what is still pending. Then use a fixed set of folders so every investor, lawyer and accountant finds things in the same place.

Label unaudited numbers as subject to audit, and date every version. An investor who finds two undated versions of the same spreadsheet will assume the worse one is true.

• Corporate and constitutional: incorporation certificate, MoA and AoA as amended, board and shareholder minutes, statutory registers
• Cap table and securities: fully diluted cap table, share certificates or demat records, PAS-3 filings, convertible note, CCPS and CCD documents
• Financials: audited statements, current management accounts, MIS, budget and projections
• Tax: income tax returns and assessments, TDS returns, GST returns and notices
• Legal and contracts: customer, vendor, lease and loan agreements, and any litigation
• FEMA and regulatory: FC-GPR, FC-TRS and FLA filings, valuation reports, licences
• HR and ESOP: employment and consultant contracts, ESOP plan and grant letters, PF and ESIC records
• Commercial: customer metrics, pipeline, unit economics and pricing
• IP and technology: IP assignments, trademark filings, open-source use, architecture notes
• Data protection: privacy notices, consent flows, processor agreements, security policies

The red flags diligence finds

Typical diligence findings are not fraud. They are paperwork gaps that were cheap to fix at the time and expensive to fix under a deadline. Check for these before an investor does.

Fix what you can before the room opens, and disclose what you cannot. A known issue with a remediation plan usually becomes a condition precedent; an issue the investor discovers costs you trust and often a price discussion.

• Earlier SAFE-style or convertible agreements that are undocumented or do not fit FEMA rules for foreign investors
• Unsigned board or shareholder resolutions, or PAS-3 not filed for an allotment
• An ESOP plan copied from a US template that does not follow Indian company law
• Missing or late FC-GPR, FC-TRS or FLA filings
• A cap table that does not match across MCA records, FEMA filings and the shareholders agreement
• No written IP assignment from founders, freelancers or an outsourced development agency
• Foreign payments made without Form 15CA and 15CB where required
• No data processing agreements with vendors that handle customer data
• Stale valuation reports, or reports that do not support the price at which shares were issued

Stage access: not everything on day one

Share in stages. A teaser and deck go out first, financial detail follows real interest, and the full room opens only after a signed NDA, usually when a term sheet is close or signed. Customer names, individual salaries and source code can wait for confirmatory diligence.

Use a proper virtual data room, or at least a tightly controlled shared drive, with these controls in place.

• Named users only, with no shared logins
• Folder-level permissions, so a co-investor or lender sees only what it needs
• View-only access and watermarking for sensitive files
• An access log you actually review
• Prompt removal of access when an investor drops out
• One question-and-answer channel, so answers stay consistent

Redaction and the DPDP Act

A data room is full of personal data: employee PAN and Aadhaar details, salaries, bank accounts, dates of birth and customer records. Under the Digital Personal Data Protection Act, 2023, your company answers for how that data is shared, and the rules under the Act are coming into force in phases. Sending a raw payroll register to five funds is hard to defend.

Mask identity numbers, bank details and dates of birth. Show salaries by band unless an investor needs individual figures at the confirmatory stage. Flatten PDFs so redactions cannot be undone, keep the unredacted master outside the room, and aggregate customer data wherever you can.

Answer the questions before they are asked

Investors ask many of the same questions in every round. Short written answers prepared in advance shorten diligence and keep founders consistent across meetings.

Keep each answer factual and short, and link it to the document that supports it.

• How was each earlier round priced, and was a valuation report obtained where the law required one?
• Is every allotment reflected in PAS-3 and, for foreign investors, in FC-GPR?
• Who owns the code, and is every contributor covered by a written assignment?
• How concentrated is revenue, and when do the top contracts renew?
• What related-party transactions exist, and were they approved?
• Are there tax notices, GST mismatches or pending assessments?
• What personal data do you hold, and where is it processed?

Who should build the room

The founder should own the narrative and the commercial folder. The finance, tax, FEMA and company law folders are better built by your CA or virtual CFO, who can spot a missing filing before an investor does, and the legal folder by your lawyer.

Start two to three months before you plan to raise, run a mock diligence against the red flag list, and fix the gaps while you still control the timeline. The same room, kept current, makes the next round faster.

Frequently asked questions

What documents do investors ask for in due diligence in India?

Typically constitutional documents and minutes, the cap table and allotment filings, audited and management accounts, tax and GST records, key contracts, FEMA filings if there is foreign money, HR and ESOP documents, IP assignments and data protection policies. The ten folders above cover the usual request list.

When should a startup open its data room?

Build it before you start meeting investors, share a light version after first meetings, and open the full room after an NDA once there is serious interest or a term sheet. Opening everything on day one adds risk without speeding up the round.

Can we share employee and customer data with investors?

Share the minimum needed, redacted or aggregated, under an NDA and access controls. Sharing personal data is governed by the Digital Personal Data Protection Act, 2023 and its rules, so take advice before sharing identifiable records.

What if diligence finds a compliance gap?

Most gaps can be cured, for example a late FEMA filing through the late submission fee or compounding route, or a missing IP assignment through a fresh confirmatory assignment. Disclose it, show the fix, and expect it to become a condition of closing.

Related guides

• Term sheet clauses that matter
• FC-GPR filing guide
• Startup fundraising in India
• Startup and fundraising advisory services