DPDP Act for Real Estate Marketing: What Builders and Brokers Must Change Before May 2027

The Digital Personal Data Protection Act 2023 is India's law on how organisations collect, use, store and delete personal data, and the DPDP Rules 2025 spell out how it works in practice. Personal data in your world means names, phone numbers, email addresses, budgets, family details and site visit records. If you can identify a buyer from it, it counts.

The DPDP Act for real estate is not a separate rulebook. The same duties apply to a builder, a broker or an agency, but the way property sales run makes them bite harder. Leads are copied across spreadsheets, shared with partners, called repeatedly and kept for years. Each of those habits needs a reason, a record and a limit.

The official summary is in the PIB release on the DPDP Rules 2025, published by the Press Information Bureau. Read it once yourself rather than relying on a forwarded WhatsApp summary.

For the law itself, read the Digital Personal Data Protection Act 2023 as published by the Ministry of Electronics and Information Technology (MeitY). Between the two, you can check any claim you hear at a builders' meet or in a broker group.

Not everything switches on at once. The Data Protection Board provisions apply immediately from notification. Consent manager registration begins from about November 2026. Most of the duties that touch your sales team apply 18 months after notification, around 13 May 2027.

Do not read that as 18 months of nothing. Cleaning up a messy lead base takes longer than people expect, because the data lives in places nobody has listed. A Pune developer with three live projects, two agencies and a dozen channel partners can easily have lead copies in thirty places.

Starting early also means your next campaign already collects consent the right way, instead of adding to the pile you will have to fix later. Every lead you capture with weak wording between now and May 2027 is one more record you may have to re-permission or delete.

Consent under the Rules must be free, specific, informed, unconditional and given by a clear affirmative act. A pre-ticked box fails. So does a lead form that says 'by submitting you agree to everything' with no detail. Consent for marketing calls in India has to name the purpose, for example 'call and WhatsApp me about this project and site visits'.

The notice has to be standalone, written in clear language, and itemise both the data you collect and why. A buried line inside long terms and conditions will not do. Withdrawal must be as easy as giving consent, so if a buyer opted in with one tap, they should be able to opt out with one tap or one reply.

Unconditional matters more than it sounds. If a buyer must accept marketing calls just to download a brochure, that is a bundled choice. Separate the brochure from the follow-up permission, and let people say yes to one without the other.

This sits alongside, not instead of, calling rules from TRAI and the DND registry. The overlap is covered in is cold calling illegal in India. Short version: DPDP consent does not cancel DND, and DND does not replace DPDP consent.

The easiest way to approach DPDP compliance is to stop thinking about 'the database' and walk through each place a lead enters. Every source has a different consent gap. The table below is a starting map, not a legal opinion.

Notice one pattern. Sources where the buyer types their own details (forms, WhatsApp) are easier to fix than sources where your staff type them (registers, partner sheets), because the second group has no moment where the buyer sees a notice at all. That is where most real estate teams will have the most work.

You do not need a legal department to start. You need a person who owns the work and a list. Here is a sensible order, with the reason behind each item.

A note on what a tool can and cannot do. Software can store consent status and proof, limit who sees data and flag duplicates. No tool makes a business compliant by itself. Compliance comes from your wording, your contracts and your habits.

If you only have a week, do the first three. Mapping, wording and proof of consent give you the base that every other fix depends on, and they are the ones you will be asked about first if a buyer complains.

If personal data leaks, you must inform both the Data Protection Board and the affected people. A detailed report to the Board is due within 72 hours. Picture a telecaller's phone with a full buyer sheet getting lost, or a partner posting a lead list in a public group. Those are the realistic scenarios in a sales team, far more than a dramatic hack.

The Schedule to the Act sets penalties of up to Rs 250 crore for failing to take reasonable security safeguards and up to Rs 200 crore for failing to report a breach. Those are ceilings, not what any given builder will pay, and the Board decides outcomes case by case. The sensible reading is simple: weak access control and silence after an incident are the two things to avoid.

Erasure is the other duty people forget. Data must be erased when the purpose is over, with 48 hours notice to the person before erasure where the Rules require it. The Third Schedule does not list a specific retention period for real estate, so you have to pick and document your own rule for cold leads, and be able to explain it if asked.

Take a practical example. A buyer enquired about a 2 BHK in 2024, never answered a call, and is still in your sheet. If the purpose was to discuss that enquiry and it is long over, keeping the record indefinitely is hard to defend. A written rule, applied on a schedule, is.

Most of the pain in applying the DPDP Act for real estate comes from scattered data. If leads live in six sheets and four phones, you cannot prove consent, delete on request or limit access. A single system fixes the plumbing, though not the policy. See how that works in CRM and lead management.

ArthaLeads imports Facebook and Instagram lead ads, WhatsApp chats and website forms automatically, and portal leads come in from a sheet. Duplicates are flagged, so one buyer is not copied five times across your team. Those are useful building blocks, but your notice wording, contracts and retention rule are still yours to write.

A practical order: do the mapping exercise first, on paper, before buying or changing anything. Jumping straight to a tool can simply move a consent problem from a spreadsheet into a dashboard. Start with the sources, fix the wording, then let the system carry the proof.

Finally, remember the people side. Telecallers, brokers and agency staff handle most buyer data day to day, so a short briefing on what they can export, forward and keep on personal phones will do more than a long policy document nobody reads.