Real estate developers and brokers must comply with the DPDP Act by 13 May 2027. Leads that come from portals, ads and channel partners can be used to respond to that enquiry, but bought lists and repeated promotional calls without consent are high-risk. Booking KYC (Aadhaar, PAN) must be secured and kept only as long as law requires, and channel partners who handle buyer data should be bound by contract.
- Deadline
- 13 May 2027
- Portal and ad leads
- Use for that enquiry
- Bought lead lists
- High risk
- Calls and SMS
- Also TRAI DND rules
Where real estate developers and brokers face the most DPDP risk
| Area | What to do |
|---|---|
| Leads from portals, Facebook and Google ads | Respond to the enquiry; separate opt-in for other projects |
| Channel partners sharing buyer data | Contracts covering use, security and deletion |
| Bought or shared databases | Avoid unless consent covers your use |
| Booking KYC and agreements | Secure storage, masked Aadhaar, limited access |
| Site CCTV and visitor registers | Notices and short retention |
Other rules that apply alongside the DPDP Act
- RERA disclosure and record requirements
- TRAI Telecom Commercial Communications Customer Preference Regulations, 2018
Where another law sets a stricter or longer requirement, follow both: the DPDP Act does not override sector rules on retention or storage.
Six steps to comply
- List every lead source: portals, ads, channel partners, events, walk-ins.
- Add a short notice and marketing opt-in to every landing page and form.
- Bind channel partners and CRM vendors by contract.
- Stop using purchased databases without proof of consent.
- Secure booking KYC and set retention.
- Train sales teams on DND, consent and opt-outs.
Most DPDPA duties apply from 13 May 2027, with penalties up to ₹250 crore per breach. See the DPDPA 2027 roadmap and the DPDP compliance checklist.
Want it done for you? Our DPDP compliance service covers data mapping, notices, consent, vendor contracts, breach plans and staff training for real estate developers, brokers and property portals.
Frequently asked questions
Can real estate companies call leads from property portals under DPDP?
Yes, to respond to the enquiry the buyer made. Calling them about other projects, or sharing the lead with other developers, needs their consent.
Can developers buy real estate lead lists under the DPDP Act?
It is risky. Unless the seller can show consent that covers your use, using the list breaches the Act and TRAI rules.
DPDP guides for other industries
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- DPDP compliance cost in India
- DPDP compliance for hospitals and healthcare
- DPDP compliance for edtech, schools and coaching
- DPDP compliance for fintech, nbfcs and lending apps
- DPDP compliance for e-commerce and d2c brands
- DPDP compliance for hr, staffing and recruitment firms
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.