Your sales team collects phone numbers all day from forms, portals, WhatsApp and site visits, and until now nobody asked how that data is handled. The DPDP Act for real estate leads changes that, and the main compliance date is 13 May 2027, about six months away.
This guide follows one lead from enquiry to cold folder. At each step it shows what the DPDP Act and Rules 2025 ask, and what a sales manager can change this month. It ends with a month-by-month plan and sample consent wording in English, Hindi and Marathi.
It is written for the sales floor, not for lawyers, and it is not legal advice. Have your own lawyer review the final notice and contracts.
The DPDP Act for real estate leads in 60 seconds
The Digital Personal Data Protection Act, 2023 treats a buyer's name, phone number and email as personal data. Whoever decides why and how that data is used is a data fiduciary, the Act's term for the party in charge. The buyer is the data principal. Nothing in the material we reviewed carves out small brokers, so assume you are covered and ask a lawyer about any exemption.
According to the PIB release, the DPDP Rules, 2025 were notified in November 2025 with an 18-month phased compliance period. Legal500's summary says Rules 3, 5 to 16, 22 and 23 come into force on 13 May 2027. Those cover notice, consent, security, breach reporting and the rights of the buyer.
Two timing notes. Consent Manager registration opens on 13 November 2026, so you are roughly six months out. Business Standard reported in January 2026 that MeitY was discussing a shorter 12-month timeline for key provisions, citing sources. We have not seen that notified, so treat 13 May 2027 as the date, check MeitY before you rely on it, and start early.
Follow one lead: where the data lives today
One enquiry rarely stays in one place. Follow a single lead from a Meta form to the cold-lead folder and you will find personal data in at least seven places.
| Stage | Where the data sits | Change this month |
|---|---|---|
| Meta or website form | Form, ad account, email alert | Add a notice and consent line |
| Portal enquiry | CSV or Excel download | Limit who can download |
| Telecaller call | Personal phone, notebook | Log calls in one shared system |
| WhatsApp chat | Team phones | Use one business number, note opt-outs |
| Partner share | Forwarded Excel, WhatsApp group | Share fewer fields, agree terms |
| Site visit | Visitor register, QR form | Put the notice at the desk |
| Cold folder | Old sheets, laptops | Set a retention period |
Most of the risk sits in the copies. Every forwarded Excel and every broker group is another place where the list can leak. For call timing and the 7-day enquiry rule, our post on TRAI rules for real estate calls covers it, so we do not repeat it here.
Consent or voluntary enquiry: when can you call back?
Section 7(a) lets a fiduciary process data for the specified purpose for which the person voluntarily provided it, unless she has said she does not consent. Commentary on consent.in reads 'voluntarily provided' as the person starting the transfer unprompted. A buyer who fills your form or WhatsApps 'send me the brochure' fits that reading. This is commentary, not settled law.
- Enquiry about Project A, you call about Project A: usually safe, because that is the purpose the buyer had in mind.
- Marketing a new launch or unrelated project: generally needs consent under Section 6, according to commentary that is not yet tested.
- Passing the number to a partner or another developer: treat as needing consent.
- Anyone who says stop: record it and stop, whatever the original source.
Bought lists are the weak spot. People on a 'real estate leads database' did not come to you, so the 'voluntarily provided' ground fits badly, and calling them also raises DND questions. If your team messages buyers on WhatsApp, our post on WhatsApp marketing for real estate covers the opt-in side.
What a compliant enquiry-form notice looks like
Rule 3 asks for a standalone, clear notice. It must itemise the personal data collected and the purposes it serves, and give a link or means to withdraw consent, exercise rights and complain to the Board. Section 6(3) says the request must be in English or an Eighth Schedule language, with contact details of the data protection officer or another authorised person.
Hindi and Marathi are Eighth Schedule languages. Hinglish is not, so our reading is that the notice should be in proper Hindi or Marathi even if your telecallers speak Hinglish. Do not bundle call, marketing and partner sharing under one tick box, which practitioner commentary flags as a failure pattern.
Sample wording (adapt it, and have a lawyer review it)
English: I agree that {company name} may use my name, phone number and email to call, WhatsApp or email me about {project name} and to arrange a site visit. I can withdraw this consent at any time at {link}.
हिंदी: मैं सहमत हूँ कि {कंपनी का नाम} मेरा नाम, फ़ोन नंबर और ईमेल का उपयोग {प्रोजेक्ट का नाम} के बारे में कॉल, व्हाट्सऐप या ईमेल से मुझसे संपर्क करने और साइट विज़िट तय करने के लिए कर सकती है। मैं यह सहमति कभी भी {लिंक} पर वापस ले सकता/सकती हूँ।
मराठी: मी सहमत आहे की {कंपनीचे नाव} यांनी माझे नाव, फोन नंबर आणि ईमेल {प्रकल्पाचे नाव} बद्दल कॉल, व्हॉट्सअॅप किंवा ईमेलने मला संपर्क करण्यासाठी आणि साइट व्हिजिट ठरवण्यासाठी वापरावे. ही संमती मी कधीही {लिंक} वर मागे घेऊ शकतो/शकते.
Keep partner sharing and new-launch marketing as separate, unticked boxes. Link the full notice and name a contact person next to the form.
Sharing leads with channel partners: put it in writing
Practitioner commentary from Consently and Siggnals says a developer stays liable if a channel partner misuses the lead data it was given, and recommends written agreements. Ask your lawyer to confirm how Section 8 applies to partners who handle data on your behalf. Rule 6 also expects contracts with processors to include security safeguards.
- Partner uses the leads only for the named project and purpose
- No forwarding to other brokers or WhatsApp groups
- Access limited to the people who need it
- Data returned or deleted when the arrangement ends
- Partner tells you at once about any leak
- You share name and phone, not PAN or financial details before booking
If you are the broker, you collect enquiries of your own, so the same duties apply to you. Our post on tracking bookings and brokerage across developers shows how to keep partner records tidy.
Security, breaches and the cold-lead folder
Rule 6 lists minimum safeguards: encryption, access control, logs and monitoring of access. Logs and relevant personal data must be kept for one year. On a sales floor that means each telecaller sees only assigned leads, nobody shares a login, exports are limited and logged, and an ex-employee loses access on the last day.
Rule 7 is the breach clock. According to Medianama's explainer, affected people must be told without delay and the Board needs a detailed report within 72 hours, which it can extend on a written request. Decide today who owns that call.
Old and cold leads
One commentary on consent.in reads Section 5(2) as requiring a one-time notice for data collected before the Act if you still use it. The same page says the Act does not clearly let a notice validate old processing, so do not assume a notice cleans a stale list.
The research gives no fixed retention period, so set your own in writing. For example, if a lead has not replied to follow-ups for 12 months, mark it cold, stop marketing messages and delete or archive it after review. Keep records of booked customers as your lawyer and accountant advise.
Penalties in plain numbers
The Schedule to the Act sets the maximum penalties, listed on dpdprules.org.
| Failure | Maximum penalty |
|---|---|
| Reasonable security safeguards (Section 8(5)) | ₹250 crore |
| Notifying a breach | ₹200 crore |
| Children's data provisions | ₹200 crore |
| Other breaches | ₹50 crore |
| Data principal's own duties | ₹10,000 |
These are ceilings, not fixed fines. The Board weighs the circumstances under Section 33(2). For a small broker, the realistic risk is a leaked list, an ex-employee still holding data, or a buyer who keeps being called after asking to stop. Those are the cases to fix first.
A 6-month checklist to 13 May 2027, and where a CRM helps
Month 1 (November 2026)
Map every place lead data sits and name an owner for each. Stop buying lists.
Month 2 (December 2026)
Draft the notice and consent lines in English, Hindi and Marathi, and get a lawyer to review them.
Month 3 (January 2027)
Update Meta forms, website forms and site QR pages with the notice and a privacy page link.
Month 4 (February 2027)
Sign written terms with partners and vendors, and cut the fields you share.
Month 5 (March 2027)
Remove shared logins, limit exports, and run a breach drill against the 72-hour clock.
Month 6 (April 2027)
Clean the cold-lead folder, test the withdrawal link and train the whole team.
On 13 May 2027 the main Rules apply, so April is for fixing gaps, not starting.
How a CRM helps, and what to ask any vendor
A CRM helps mainly by cutting copies. When enquiries from Meta, WhatsApp, forms and portal CSVs sit in one lead record and are assigned to one person, fewer spreadsheets travel around. See our page on real estate lead management software for how that works.
- Can each user see only the leads assigned to them?
- Is there a log of who viewed or exported data, and for how long is it kept?
- Is there an opt-out flag that stops calls and messages?
- Where is data stored, and what does the vendor's contract say about security?
- Can you delete a lead on request, and remove a departed user at once?
Ask us the same questions. No software makes you compliant on its own, and we do not claim a DPDP certification. Arthaleads is real estate CRM software for builders, developers, channel partners and brokers, with a 14-day free trial of Growth and no credit card.
Frequently asked questions
Does the DPDP Act apply to real estate brokers and small channel partners?
The material we reviewed does not carve out small brokers. Anyone who decides why and how buyers' personal data is used is a data fiduciary. Ask a lawyer whether any exemption fits your business before assuming you are outside it.
Do I need consent before calling someone who filled my enquiry form?
Section 7(a) allows processing for the purpose for which the person voluntarily gave the data, unless they have said no. Calling back about the project they enquired about usually fits. Marketing other projects or sharing the number generally needs consent, and this reading is commentary rather than settled law.
When does DPDP compliance become mandatory, and is it 13 May 2027?
Rules 3, 5 to 16, 22 and 23, covering notice, consent, security, breach reporting and user rights, come into force on 13 May 2027. MeitY has discussed shortening the timeline for some provisions, but we have not seen that notified. Treat 13 May 2027 as the date and start early.
What happens to my old Excel lead lists?
Commentary reads Section 5(2) as asking for a one-time notice if you still use data collected before the Act. The same source says the Act does not clearly let a notice validate old processing. Review old lists, keep the ones with a clear enquiry history, and delete or archive the rest.
What is the penalty if a sales employee leaks the lead list?
The Schedule sets up to ₹250 crore for failing reasonable security safeguards and up to ₹200 crore for failing to notify a breach. These are maximums, and the Board weighs the circumstances. Access control, logs and a tested breach plan are your best protection.
Is buying a real estate leads database legal in India?
This article is not legal advice, but people on a bought list did not voluntarily give you their data, so the Section 7(a) ground fits badly. Calls to them also raise TRAI and DND questions. Enquiries that come to you directly carry less risk.
About Arthaleads
Arthaleads is a CRM for Indian real estate sales teams. It brings enquiries from ads, portals, your website and WhatsApp into one workspace, with follow-ups, projects, bookings and invoices. These articles are educational and are not a substitute for advice based on your own business and data.