DPDP Act compliance checklist for real estate: what builders, brokers and CPs must do with buyer data, and by when

Any DPDP Act compliance checklist for real estate starts with who is covered, and that is a builder, broker or channel partner from the day a buyer's details are kept in digital form, even on an Excel sheet. The firm that decides why and how that data gets used then has to tell buyers what it collects and why, use it only for that, keep it safe, report breaches, deal with buyers' requests and erase what it no longer needs. Most of these duties, from the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, apply from 13/05/2027, so below we turn them into tasks for a sales team, with the section behind each one.

DPDP Act implementation dates: when the duties start

The Act starts in phases, on dates set by notification G.S.R. 843(E) and rule 1 of the DPDP Rules, 2025 (G.S.R. 846(E)), both in the Gazette dated 13/11/2025. Neither notification prints a calendar date. We counted one year and eighteen months from the Gazette date, 13/11/2025. If you count from 14/11/2025, the day the Rules were announced, each date moves one day later.

The dates may move. In January 2026 MeitY asked industry for comments on cutting the 18 months to 12, which would mean 13/11/2026. Reports differ on the scope: Business Standard (22/01/2026) describes the cut for Significant Data Fiduciaries, with the one-year retention rule starting 90 days after an amendment, while SS Rana & Co. (13/02/2026) reads it more broadly. We found no notification making any change when we checked on 22/10/2026.

The government's release of 14/11/2025 called this "an 18-month phased compliance timeline", and two later notices, a corrigendum to the Rules (G.S.R. 892(E)) and the Removal of Difficulties Order, 2026 (S.O. 5458(E)), only touched the wording and left the dates alone.

Till 13/05/2027 section 43A of the IT Act, 2000 still makes a company, firm or sole proprietor that is negligent in securing "sensitive personal data or information", and so causes wrongful loss or gain, compensate the person affected. On that date the DPDP Act deletes it (section 44(2)).

DPDP Act compliance checklist: what to do now and before 13/05/2027

The last column gives the section or rule for each task.

Who is who under the DPDP Act in real estate

As the fiduciary you stay responsible for whatever your processors do for you, "irrespective of any agreement to the contrary" (section 8(1)), and you can use one only under a valid contract (section 8(2)). The same buyer can have two fiduciaries, the builder and the CP who brought her, because each decides its own purposes. Even a paper form from the sales lounge counts once typed or scanned in (section 3(a)).

Notice and consent: what the buyer must be told

If you rely on consent, the notice must go with the request or before it (section 5(1)). Under rule 3 that notice must stand on its own and give, in clear and plain language, an itemised description of the personal data and the specified purposes, plus a link to your website or app, explaining how the buyer can withdraw consent, use her rights and complain to the Board. She must also get the option to read it in English or in any language of the Constitution's Eighth Schedule, Hindi or Marathi for example (sections 5(3) and 6(3)).

The consent itself must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data the purpose needs (section 6(1)). In practice that means one choice per purpose with nothing pre-ticked, since calls about the project she asked about, offers on your other projects and sharing with a CP are three different purposes. Withdrawing has to be as easy as consenting was (section 6(4)), and once she withdraws, you and your processors stop within a reasonable time, unless a law requires the processing (section 6(6)).

If consent is questioned, you must prove the notice and the consent (section 6(10)), so store what was shown, when, in which language and what she chose. For buyers who consented before the Act started, send the notice "as soon as it is reasonably practicable" (section 5(2)); you may keep processing until she withdraws.

When you can use buyer data without consent

Section 7 lists "certain legitimate uses" that need no consent. The one sales teams meet daily is data a person "voluntarily provided" for a specified purpose, unless she has said she does not consent (section 7(a)). The Act's illustration is about a broker:

X, an individual, electronically messages Y, a real estate broker, requesting Y to help identify a suitable rented accommodation for her and shares her personal data for this purpose. Y may process her personal data to identify and intimate to her the details of accommodation available on rent. Subsequently, X informs Y that X no longer needs help from Y. Y shall cease to process the personal data of X.

In sales terms, answer the enquiry the buyer actually made, stop when she says so and ask before using her number for anything else. Other legitimate uses, court orders or employment for instance (sections 7(e) and 7(i)), hardly ever cover sales work.

Portal leads, CPs, WhatsApp and KYC

Portal and ad leads

A lead from 99acres, MagicBricks, Housing.com or a Meta or Google form came in under that platform's notice, so check what that form told the buyer about who would call and why, and keep to it. The first time you get in touch, by call or message, say who you are, where you got the number and how she can stop hearing from you, and record any consent you ask for. A bought list of people who never dealt with you rarely fits consent or section 7(a), so ask your advocate before you touch one. The rest of the enquiry-to-site-visit process is in our guide to real estate lead management.

Promotional SMS and calls also have to follow TRAI's separate rules for commercial SMS and calls, with their own registered headers and templates, DND preferences and consent (PIB, 12/02/2025).

Leads shared between a builder and a CP

When a CP registers a buyer with a builder, it discloses personal data to another fiduciary. The data must then be complete, accurate and consistent (section 8(3)), and the buyer can ask each of you whom you shared it with (section 11(1)(b)). Name the builder in the CP's notice, log each share, and settle in the CP agreement who answers for what, how fast each side reports a breach and what happens to the data at the end. A CP or call centre that only calls your leads for you is likely your processor, which needs a valid contract (section 8(2)).

WhatsApp chats and call recordings

Chats, voice notes and call recordings are personal data too. A salesperson's own phone is the wrong place for business chats, so keep them in accounts the firm controls, where you can secure, retrieve and erase them. If you record calls, say so in your notice, limit who can play them back and fix how long they are kept.

KYC documents

For KYC, collect only the PAN, address proof, photographs and bank details the booking and the law need (section 6(1)), and keep them locked down, numbers masked on screen and copies out of chat threads. Aadhaar comes under its own law, the Aadhaar Act, 2016, which limits how Aadhaar information is shared and displayed (section 29), so ask your advocate before collecting it. An NRI buyer's data may be stored or sent abroad, to an overseas cloud or an NRI desk say, unless the government restricts that country by notification (section 16(1)) or sets conditions by order (rule 15).

Security, breaches and the 72-hour report

Section 8(5) requires "reasonable security safeguards", your processors' work included. Rule 6 sets the floor, which in practice means encrypting or masking buyer data, controlling who can open it, keeping access logs and reviewing them, taking backups, holding those logs and the data for a year, writing security terms into every processor contract and making sure all of it actually works.

A breach is wider than a hack, since it also takes in accidental disclosure and loss of access (section 2(u)). When one happens, rule 7 gives you two tracks:

• Each affected buyer, without delay, through her account or registered contact: what happened, the likely consequences for her, what you are doing, what she can do, and a contact person (rule 7(1)).
• The Board hears from you without delay too, with the nature, extent, timing, location and likely impact of the breach. Within 72 hours of your becoming aware, or longer only if the Board allows it on a written request, it gets a detailed report on the causes, mitigation, who caused it, steps to prevent a repeat and the messages sent to buyers (rule 7(2)).

Cold leads and cancelled bookings: what to keep, what to erase

Section 8(7) asks you to erase personal data when the buyer withdraws consent or "as soon as it is reasonable to assume that the specified purpose is no longer being served", and to make your processors erase it too, unless a law requires you to keep it.

Cold leads. The Rules fix an inactivity period only for large e-commerce, online gaming and social media platforms (rule 8(1) and the Third Schedule), so a builder or broker has to judge this itself; write your period down. Note the Act's test: a buyer has not "approached" you in any period in which she did not initiate contact herself (section 8(11)). Your follow-up calls do not keep a lead alive.

The one-year floor. Rule 8(3) asks you to keep the personal data, traffic data and logs of each processing for at least a year from that processing, for the State's uses listed in the Seventh Schedule, then erase them unless another law needs them longer. That means erasing in two steps, where you first stop using the data and lock it away, and delete it only after the floor has passed.

Cancelled bookings. Stop marketing, but keep what the refund, your accounts and any dispute need. Retention that a law requires is allowed (section 8(7)), and data needed to enforce a legal right or claim is outside most of the Act's duties, though not the security duty (section 17(1)(a)).

Buyers' rights and your grievance desk

• Access (section 11): a summary of her data and its processing, and everyone you shared it with.
• Correction and erasure (section 12): she can have her data corrected, completed or updated, and erased unless the purpose or a law still needs it.
• Grievance (section 13): she must come to you first and can go to the Board only after that, and under rule 14(3) you have at most 90 days to respond.
• Nomination (section 14): someone to act for her on death or incapacity.

Publish how buyers can make these requests and what identifier you need, such as the registered mobile (rule 14(1)), plus a contact person for data questions, repeated in every reply (section 8(9) and rule 9).

Children's data, consent managers and DPDP Act penalties

Children. Anyone under 18 is a child for the Act (section 2(f)), and a booking can name one, as a co-owner for instance. Before you process that child's data you need verifiable consent from a parent or lawful guardian (section 9(1) and rule 10), and you may not track children or target advertising at them (section 9(3)).

Consent managers. From 13/11/2026, Indian companies with a net worth of at least ₹2 crore can apply to the Board to register (rule 4 and the First Schedule). From 13/05/2027, a buyer may give or withdraw consent to you through a registered consent manager (section 6(7)), and you must honour a withdrawal that arrives that way.

Penalties. The Board can impose one only after an inquiry finds a "significant" breach, and weighs factors such as its gravity and duration in setting the amount (section 33). The Schedule's maximums include:

Where a CRM helps, and where it cannot

Your CRM vendor is your Data Processor, and section 8(1) keeps you responsible for it. The notice, purposes, retention periods and breach response are your decisions; software can only make the right action the easy one. Here is what Saudaflow, the CRM we build, says on its own pages:

• Call and WhatsApp preferences can be "allowed, refused or not recorded", and an unknown value "is not silently converted into permission or refusal" (lead management).
• A buyer whose record says they refused calls gets a disabled Call button that says so. Company-call recording is not live, and no workspace has a company calling line today (calling and call logging).
• Opening a record "does not automatically grant permission to export it or see every sensitive field", sensitive product actions carry audit records where implemented, and the page makes no blanket DPDP compliance claim (Saudaflow security and privacy).

For questions to ask any vendor in a demo, see our guide to choosing a real estate CRM in India.

Checked against the DPDP Act, 2023; notifications G.S.R. 843(E) and 844(E); the DPDP Rules, 2025 (G.S.R. 846(E)) and corrigenda (G.S.R. 892(E)); S.O. 5458(E); PIB's release of 14/11/2025; section 43A of the IT Act, 2000; and section 29 of the Aadhaar Act, 2016, on 16/10/2026. On 22/10/2026 we went back over the Act, G.S.R. 843(E), rule 6, MeitY's published DPDP notifications, SS Rana & Co.'s note of 13/02/2026, PIB's release of 12/02/2025 and the Saudaflow pages quoted. Take it as general information, not legal advice, and for your own case speak to your advocate.