Lead databases shared across brokers and lenders are a compliance liability.
Real estate platforms collect KYC, financial details, and location preferences, then route them across broker networks, lending partners, and developer co-marketing programmes. Under DPDP, every handoff needs a lawful basis, every downstream party needs a contract, and stale lead databases are a sitting liability. We build the consent flows, distribution agreements, and retention policies that make your data chain compliant.
Six entities. One buyer's data touching all of them.
Real estate data flows are wide and informal. A single enquiry can reach brokers, lenders, developers, and valuation firms before the buyer has received a single callback. Under DPDP, every link in that chain needs a legal basis.
Buyer / Seller
Data Principal
Data handled
Name, PAN, Aadhaar, income proof, financial details, location preferences, family composition
DPDP obligation
Consent required per purpose. Lead generation consent does not cover sharing with lenders, brokers, or co-marketing partners.
Proptech Platform
Primary Data Fiduciary
Data handled
Full KYC, search behaviour, saved properties, enquiry history, financial filters
DPDP obligation
Owns notice, purpose-specific consent, rights fulfilment, retention limits for stale leads, and breach notification.
Broker Network
Data Processor or Independent Fiduciary
Data handled
Lead details, contact information, financial capacity indicators
DPDP obligation
If the broker independently determines how they use the lead data, they are a Fiduciary. If following platform instructions, a processor contract is required.
Lending Partners (Banks, HFCs, NBFCs)
Independent Data Fiduciary
Data handled
Financial profile, KYC, income documents, credit indicators
DPDP obligation
Sharing lead data with lenders for home loan pre-qualification requires separate, specific consent from the buyer before transfer.
Valuation and Legal Due Diligence Vendors
Data Processor
Data handled
Property documents, owner KYC, transaction history
DPDP obligation
Processor contract required. Access must be limited to documents necessary for the specific transaction.
Co-marketing and Developer Partners
Independent Data Fiduciary
Data handled
Buyer enquiry data, preference profiles, contact details
DPDP obligation
Co-marketing with developers using shared buyer data requires independent consent for each developer's marketing purpose.
Five obligations. All of them are engineering problems.
Lawful basis for every lead data handoff
A buyer's consent to receive property listings is not consent to be contacted by five brokers, pre-qualified for a home loan, or enrolled in a developer's marketing programme. Each downstream use is a separate purpose requiring its own consent. We rebuild your lead capture and distribution flows to capture purpose-specific consent at the point of collection.
Broker and lender agreements
Every broker, lending partner, valuation firm, and co-marketing developer that receives buyer data needs a formal agreement. For processors, that is a DPA covering purpose limitation, security, sub-processor disclosure, and breach cooperation. For independent Fiduciaries — lenders who independently underwrite the data — separate consent from the buyer is required before the handoff. We map every distribution relationship and implement the right mechanism for each.
Stale lead data erasure
Most real estate CRMs contain years of lead data with no active purpose and no current consent. Under DPDP, personal data must be erased when the purpose is served and no legal basis for retention exists. Stale leads are a major exposure. We conduct a historical data audit, document retention bases where they exist, and implement automated deletion for data beyond its lawful retention window.
Data principal rights portal
Buyers and sellers have the right to access their data, correct inaccuracies, and request erasure of data that is no longer needed. Under Rule 14, you must respond within seven days. We build a rights portal integrated into your platform that handles requests end-to-end and generates audit trails for every response.
Breach notification within 72 hours
A breach of your lead database affects the financial and personal details of potentially thousands of buyers. The 72-hour notification clock starts from when you become aware of the breach. We build a breach runbook and detection integrations so your team can respond in time — not improvise under pressure.
Questions we get from real estate platforms.
We share leads with brokers as part of our core business model. Does every share need consent?
Yes, if brokers independently determine how they use that lead data. The buyer consented to be contacted through your platform — not necessarily to have their financial details and contact information transferred to third parties for independent follow-up. The purpose of the broker's use must be disclosed in the original notice, and consent must cover that specific use.
How does home loan referral work under DPDP?
Sharing a buyer's financial profile with a lending partner for loan pre-qualification is a new purpose — separate from the property search that brought the buyer to your platform. It requires its own consent: the buyer must affirmatively agree, before the transfer, to have their data shared with the lender for that specific purpose. Pre-checked referral agreements embedded in sign-up flows are not valid.
We have ten years of enquiry data in our CRM. What do we do with it?
First, audit it. Classify records by whether there is an active relationship, a lawful basis for continued retention, or neither. Where the purpose is served and no legal or contractual basis exists, deletion is required. This is not a one-time exercise — it needs to be built into your CRM as an ongoing retention policy with automated review cycles.
Do property developers who post listings on our platform share our data obligations?
Partially. Developers using your platform to market their projects and capture buyer enquiries may be Fiduciaries for the data they independently collect and act on. If you are simply passing buyer enquiries to them at the buyer's request, you are acting as a processor for that activity. The line depends on who controls the purpose of the interaction. Clear contractual role allocation is essential.
What happens to buyer data after a property transaction is completed?
Transaction records may have a retention basis under stamp duty, registration, or income tax laws — these override DPDP erasure rights where applicable. But marketing data, search history, and financial preference data collected during the search phase has no such statutory basis. Once the transaction purpose is served, that data must be erased unless the buyer has given separate consent for continued use.
Penalties under the DPDP Act can reach ₹250 crore per violation. This engagement covers the technical and product layer of compliance. Pair it with your legal counsel for full coverage, including RERA obligations and stamp duty record retention requirements.