DPDP Act for Real Estate Developers, Brokers & Housing Societies
Developers, brokers, property portals, housing societies and facility managers collect IDs, financial details, family information and visitor records. Leads often pass along long chains, and cold-calling is common. The DPDP Act and Rules apply to all of it.
Real estate has two typical weak spots: lead data that moves between portals, brokers and developers without a consent trail, and records such as buyer KYC, tenant verification and visitor logs that sit in unsecured files and chat groups. A simple notice, controlled lead sharing and retention periods go a long way. Most duties take effect on 13 May 2027.
Who this covers
Developers and builders are Data Fiduciaries for buyer, investor and employee data.
Brokers and channel partners collect leads and often act on their own account.
Property portals and classifieds are fiduciaries for listings, enquiries and agent data.
Housing societies, RWAs and facility managers hold resident, visitor and vehicle data, often through apps.
Landlords, property managers and co-living operators verify tenants and keep their records.
Personal data you are likely to hold
Key provisions for Real Estate & Construction
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
Itemised notice and consent for marketing, lead sharing and call follow-up.
Data voluntarily given for a stated purpose, such as a site-visit booking, and disclosures the State requires by law, are legitimate uses.
Security, accuracy, breach intimation, erasure and processor contracts.
Erasure gives way where law requires retention.
A grievance process that buyers, tenants and residents can use.
Transfers abroad, for example for NRI buyers, are allowed unless a country is restricted.
Penalties up to ₹250 crore for security failures.
01Leads, enquiries and marketing
A person who fills in an enquiry form has given their details for that stated purpose. Using them to answer that enquiry is a legitimate use under Section 7. Calling them about unrelated projects, passing them to other developers or adding them to broadcast lists is a different purpose and needs consent.
- Say in the form who receives the lead: your sales team, named channel partners, a bank for loans.
- Do not resell leads to unnamed third parties.
- Honour opt-outs across your CRM, dialer and partners, and keep calls consistent with TRAI's rules.
- Keep a record of the consent and form version for each lead.
02Buyer KYC, loans and transaction records
Buyers provide identity, income and bank details for bookings, agreements and loans. Use them only for the transaction and legal compliance, restrict access, and share with banks, registrars and tax authorities only as needed. Records law requires you to keep, such as those under RERA, tax and registration laws, can be retained under Section 8. Erase marketing profiles and dropped enquiries once the purpose ends.
Project teams should not keep buyer ID scans in personal phones, shared chat groups or unlocked folders. Use controlled storage with access logs.
03Tenant verification and rental platforms
Landlords, brokers and rental platforms collect IDs, employment details, references and sometimes police-verification forms. Collect what verification needs, keep it secure and delete it after the tenancy and any required retention period. When a platform shares tenant data with landlords, make sure the tenant knows and has agreed. Third-party background-check vendors are Data Processors and need a written contract.
04Housing societies, visitors and CCTV
Societies and RWAs run visitor-management apps, vehicle registers and CCTV. They decide why and how the data is used, so they are Data Fiduciaries, even though volunteer-run.
- Display clear notices where CCTV and visitor registration operate.
- Do not publish residents' phone numbers, vehicle numbers or defaulter lists on notice boards or open WhatsApp groups.
- Limit who can see footage and visitor logs, and set a deletion period.
- Choose app vendors with written terms, since they are Data Processors.
Purely personal or domestic use by an individual is outside the Act, but a society or business is not an individual household.
05Security, retention and breaches
Apply the Rule 6 baseline: encryption, access control, logging and backups. A breach means telling each affected person and the Board, with a detailed report within 72 hours (Rule 7). Set retention periods by record type, and use Rule 9 to publish a contact for queries.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
The enquirer must have been told and have agreed to that sharing. Without it, limit the lead to the project they asked about.
Move them to controlled storage, restrict access and delete the copies. Aadhaar handling has its own legal limits.
Do not publish it openly. Use direct, private communication and limit who sees the data.
Keep only what the law requires for the required period, then erase.
If you are the fiduciary, notify affected buyers and the Board. Tighten channel-partner contracts and data access.
Compliance checklist
Common mistakes to avoid
Treating every enquirer as consenting to calls from anyone.
Keeping buyer ID documents in personal phones.
Sharing leads with every broker in the chain.
Naming and shaming defaulting residents in public groups.
Never deleting anything from completed or cancelled deals.
Common questions
Does a housing society have to comply?
Yes. A society that decides why and how it processes resident, visitor and CCTV data is a Data Fiduciary, whatever its size.
Can brokers share leads with developers?
Only if the person was told and agreed, or the data is shared as part of fulfilling the specific enquiry they made. Broad resale of leads needs consent.
How long should we keep buyer documents?
For as long as the transaction, RERA, tax and registration laws require. After that, erase them.
Is tenant police verification covered?
Yes. Collect only what the process needs, secure it and delete it after the required period.
Do NRI buyers change anything?
Transfers abroad are allowed unless restricted, but you remain responsible for the data, and financial-sector rules may add requirements.
What are the penalties?
Up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to report a breach. The Board decides the actual amount.