Sector guide · Real estate
DPDP Act for real estate developers and brokers
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Real estate runs on leads: site visit forms, portal enquiries, broker referrals and call-centre lists. Every one of those is personal data with a purpose attached. The Act requires consent for marketing beyond the enquiry, a notice that says who the lead is shared with, contracts with every portal and agency, and erasure once the enquiry is dead.
The lead is the purpose
A buyer who fills a form about one project has provided data voluntarily for that enquiry, a Section 7(a) ground. Passing the lead to three other projects, a home-loan partner and a broker network is a new purpose that needs consent under Section 6, and the Rule 3 notice must have said it would happen.
Lead sharing is the processor problem
Portals, channel partners, call centres and CRM vendors each receive the data. Where they act on the developer’s behalf they are Data Processors and need a Section 8(2) contract. Where a broker uses the lead for their own business they are a Data Fiduciary in their own right and need their own ground. A lead list emailed as a spreadsheet to a partner fails both tests.
Site visits and KYC
Site visit registers, visitor photographs and identity documents collected at booking are personal data. Section 8(5) requires reasonable security safeguards for all of it, and Rule 6 sets the floor; a register in a shared drive with no access control does not meet it. Identity documents collected for a booking have a purpose that ends with the transaction, and Section 8(7) requires erasure after it.
First five actions
- Rewrite the enquiry form notice to name the purpose and who receives the lead.
- Add a separate consent for sharing with partners and for marketing other projects.
- Sign Section 8(2) contracts with portals, call centres and CRM vendors; stop emailing spreadsheets.
- Lock down site-visit and KYC records under Rule 6.
- Set a lead retention period and erase dead enquiries on it.
Questions people ask
- Can we call a lead who enquired on a portal?
- For that enquiry, yes, under Section 7(a). For other projects or partner offers, only with consent for that purpose.
- Is a broker a Data Processor?
- When acting on your instructions for your project, yes, and needs a Section 8(2) contract. When using the lead for their own listings they are a Data Fiduciary and need their own ground.
- How long can we keep a buyer’s identity documents?
- Until the purpose is served and any legal retention period ends. RERA and registration requirements may require retention; beyond that, Section 8(7) requires erasure.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.