Does the DPDP Act apply to real estate companies?

Yes. The DPDP Act applies to any organisation processing the personal data of individuals in India, including real estate developers, brokers and channel partners. There is no sector-specific exemption for real estate. A business needs to identify the applicable ground for processing, usually consent or a specified legitimate use, for each purpose it collects lead data for.

Is consent required before calling a real estate lead?

It depends on the ground for processing and the purpose of the call. Where a person has voluntarily shared their number for a specific purpose, such as requesting a callback, a related call may draw on a specified legitimate use without separate consent. A promotional call unrelated to what the person asked for is a different purpose and generally needs its own basis. Businesses should map each type of outreach against the purpose the lead originally agreed to, instead of assuming a phone number in the CRM covers every call.

Can real estate companies use old leads for marketing?

Not automatically. An old lead's data was collected under a specific notice and purpose, and that purpose may no longer be active if the person has not engaged for an extended period. Under Section 8(7) of the DPDP Act, personal data needs to be erased once the purpose is no longer being served or consent is withdrawn, whichever comes first, unless another law requires retention. Before reusing an old database, a business should check whether the original purpose covers the new campaign, and whether the data should already have been deleted.

How should brokers and channel partners handle lead consent?

Whether a broker or channel partner is acting as a data processor on the business's behalf, or as an independent data fiduciary, depends on its role and what it does with the data. Where a partner is a processor, the DPDP Act holds the business responsible for that processing, including honouring a lead's withdrawal or erasure request. Contracts with brokers should specify what data gets shared, for what purpose, and what happens on withdrawal. Businesses should also confirm partners can stop contacting a lead once notified, since a withdrawal that reaches the CRM without reaching the broker's spreadsheet has not been honoured.

Can a CRM alone manage DPDP consent for real estate leads?

On its own, usually not. Most real estate CRMs track sales activity, not purpose-level consent, versioned notices or cross-system withdrawal propagation. A CRM can store a consent field. If that field is not connected to WhatsApp, email and partner systems, a withdrawal recorded there will not stop outreach happening elsewhere. A dedicated consent layer, built in-house or through a consent management platform, connects lead sources to every downstream system and keeps one auditable record the CRM can read from.

DPDP Compliance for Real Estate: Managing Lead Consent Across Sales Cycles

Learn how DPDP compliance for real estate works across the full lead journey, from enquiry to booking, and how to manage consent through sales cycles.

A single lead can pass through seven or eight systems before a sale closes, and personal data collected at the first step gets reused, reshared and reprocessed at almost every step after it. Few businesses track that trail end to end.

Lead generation → CRM → Sales calls and WhatsApp → Site visit → Broker or channel partner → Booking → Customer servicing

Real estate businesses that treat this as a lead-form question, something solved once at the enquiry stage, run into trouble later. The Digital Personal Data Protection Act, 2023 (DPDP Act) applies at every stage where personal data changes hands, from the first WhatsApp enquiry through to the final possession handover.

DPDP compliance for real estate means tracking consent, purpose and preference for a lead across its entire journey, from acquisition through sales, WhatsApp outreach, site visits, broker handoffs, booking and post-sale servicing, extending well past the initial enquiry form.

When Does a Real Estate Business Need Consent?

A real estate business collects personal data at several distinct points:

Enquiry: name, mobile number, email
Qualification: budget, property preference
Site visit: visit date, attendee details
Sales: negotiation and communication history
Booking: identity and financial documents
Post-sale: agreement and service records

Not every one of these automatically requires consent. The DPDP Act allows processing on two broad grounds: consent under Section 6, and a set of specified legitimate uses under Section 7 that do not require consent. Determining which ground applies to which piece of data, for which purpose, is more useful for a business than treating every CRM field as something that needs a checkbox. The distinction does real work.

The Act's own illustrations under Section 7(a) are worth knowing here. One involves a person who messages a real estate broker unprompted, asking for help finding rented accommodation and sharing personal data for that purpose. That scenario can fall under the voluntary-provision ground, without separate consent, because the person initiated contact for a specific purpose and has not objected to that use. Most portal and website leads work differently. A business's form, campaign or landing page prompts the person to submit their details, and prompted collection generally falls back to needing consent. Businesses should not assume every inbound enquiry qualifies for the same non-consent treatment as the Act's broker illustration.

Where consent is the applicable ground, Section 6 sets a specific bar. Consent needs to be:

Free, specific and informed
Unconditional and unambiguous
Given through a clear affirmative action

A notice under Section 5 needs to precede or accompany that request, in plain language, describing what data gets collected, for what purpose, and how the person can exercise their rights.

For a real estate business, the practical implication is granularity. A person requesting a brochure, a person booking a site visit and a person agreeing to receive promotional WhatsApp updates are making three separate decisions, even inside the same form. Bundling them into one blanket marketing permission works against the specificity requirement, and it also makes a partial withdrawal harder to honour later.

Sales, Marketing and WhatsApp: Where Consent Breaks Down Day to Day

Most of the day-to-day risk in real estate lead management falls to sales and marketing operations, not to the legal team. A salesperson picking up an old lead needs to know the current communication preference before making that call. Marketing teams building a WhatsApp campaign audience need to know which leads consented to promotional messages, as distinct from those who only agreed to receive a brochure or a callback.

Businesses should distinguish service-related communication, such as a confirmed site-visit reminder, from promotional communication, such as a new project launch offer sent to the wider database. The two typically involve different purposes and different controls, so a single generic marketing opt-in at the enquiry stage should not be treated as covering both.

The same discipline applies inside the CRM. When a lead moves from marketing to inside sales, to field sales, and sometimes to a channel partner, the underlying consent record needs to move with it: what purpose the person agreed to, when, through which notice, and whether that agreement still stands. A CRM that stores only a name and phone number, with no visible consent or preference status, leaves the salesperson unable to confirm, before dialling, whether that person remains reachable for this specific purpose. It is a basic operational gap.

before any outreach, the business should be able to show what purpose that contact serves, and whether the lead's current preference still allows it. Marketing, sales and the CRM need to agree on the same answer. Getting that alignment right is most of what DPDP-ready lead management looks like in practice.

What Happens When a Lead Withdraws Consent

Withdrawal deserves a section of its own, because it is where most real estate lead processes break down. A typical sequence looks like this:

Lead withdraws consent → consent status updated → CRM record updated → marketing suppression applied → WhatsApp, SMS and email suppression applied → channel partner or processor notified → withdrawal logged as evidence

Section 6 of the DPDP Act requires withdrawal to be at least as easy as giving consent. Once a person withdraws, the business is required to stop consent-based processing within a reasonable time, and to ensure that any data processor acting on its behalf does the same. For a real estate business, that obligation extends to CRM vendors, marketing automation tools, WhatsApp providers and, depending on the relationship, channel partners and brokers who were given lead data to act on the business's behalf.

A withdrawal that updates the CRM without reaching the marketing platform, or without reaching a broker who still has the lead's number on a spreadsheet, has not been honoured in practice. The withdrawal needs to travel across every system that can still contact that person, not stop at the record where it was first entered.

Brokers, Channel Partners and Legacy Leads

Real estate lead data rarely stays inside one organisation. Channel partners, brokers, lead aggregators, call centres and marketing agencies often handle the same lead at different points. Whether a given partner is acting as a data processor, processing on the business's behalf, or as an independent data fiduciary collecting for its own purposes, depends on its role and what it does with the data. That classification needs checking partner by partner, not assuming.

Where a partner is acting as a processor, the DPDP Act makes the business responsible for the processing that partner carries out on its behalf, including honouring withdrawal and erasure requests. Contracts with brokers and channel partners should specify what data gets shared, for what purpose, and what happens when a lead withdraws consent or a listing closes. Ownership needs to be explicit on both sides.

Legacy leads raise a related question. A CRM built up over several years typically holds enquiries with no clear record of what notice was shown, what purpose was communicated, or whether consent, where it was the applicable ground, still stands. Re-obtaining consent from every old record is not automatically the right answer. The more useful exercise is to check, for each category of legacy data, whether the original purpose is still being served.

Section 8(7) of the DPDP Act requires a business to erase personal data once the specified purpose is no longer being served, or once consent is withdrawn, whichever comes first, unless another law requires retention. A three-year-old enquiry with no further contact from the lead, and no active purpose left to serve, is a candidate for deletion, not indefinite storage in case the project gets relaunched.

Connecting Consent to Every Stage of the Real Estate Lead Journey

A DPDP-ready architecture for real estate lead management connects five layers:

Lead sources → Consent and preference layer → CRM or CDP → Activation → Governance and audit

Lead sources such as the website, property portals, paid campaigns, WhatsApp, walk-ins and brokers generate data continuously. That data flows into a consent and preference layer that records purpose, consent, preference and withdrawal against a versioned notice, then into the CRM or customer data platform, carrying the lead's consent status, source and history alongside standard profile fields. Every activation, a sales call, a WhatsApp campaign or an email nurture sequence, should check that layer before the lead gets contacted. No exceptions, no manual overrides. A governance layer keeps the audit trail, suppression lists and retention records that legal and compliance teams rely on.

A dedicated consent layer, built in-house or bought as a platform, is what keeps that architecture from depending on manual checks at every handoff. OneConsent is built to work inside architecture like this, not to replace any part of it. It connects to the CRM and marketing systems a real estate business already uses. From there, it captures consent at each lead source and keeps a single, auditable consent history that travels with the lead from enquiry through to post-sale servicing. When a lead withdraws consent, OneConsent propagates that change to the connected systems instead of leaving it as an isolated CRM field, which is the specific gap described earlier in this article.

Questions Real Estate Leaders Should Ask About DPDP Readiness

Before treating DPDP compliance as a legal sign-off, leadership can test how well the answers hold up in practice by asking:

Can we identify every source through which leads enter the organisation?
Can we see the specific purpose linked to a lead's consent?
Can sales see the current communication preference before outreach?
Does a withdrawal reach every connected system, or does it stop at the CRM?
Can we identify which brokers and vendors currently hold lead data?
Can we produce the consent and processing history for a specific lead if asked?

A "no" to any of these points to a specific gap worth closing before the Act's remaining provisions take effect.

DPDP Readiness Checklist for Real Estate Lead Management

Real estate teams preparing for DPDP compliance can work through the following ahead of May 2027, when the provisions scheduled eighteen months after the Rules' November 2025 notification take effect.

Map every lead source and the personal data each one collects.
Identify the applicable ground, consent or a specified legitimate use, for each processing purpose.
Separate service communication from promotional communication in CRM and campaign settings.
Make current consent and preference status visible to sales before every call.
Confirm which channel partners and brokers act as processors, and update contracts accordingly.
Connect withdrawal handling to CRM, marketing platforms and partner notifications.
Review legacy leads against Section 8(7) erasure requirements instead of assuming indefinite retention is safe.
Assign clear ownership across marketing, sales, CRM, legal and IT, instead of leaving it with one department.

Conclusion

A real estate lead's data outlives the enquiry that created it, often by months or years, and it passes through more hands than almost any other consumer transaction. DPDP compliance for real estate works only when consent travels with the lead through every one of those hands: acquisition, qualification, sales calls, WhatsApp outreach, site visits, broker handoffs, booking and post-sale servicing.

Businesses that build this into their operating model now, ahead of the Act's phased timelines, get more time to find the gaps in existing CRM records, partner contracts and campaign workflows. Most of those gaps are organisational, not technical. Businesses that leave it until the deadline will be doing the same review under considerably more pressure.

Marketing needs to know what data can be used. Sales needs to know who can be contacted. CRM needs to hold the current state. IT needs to enforce it across systems. Legal and compliance need evidence that the controls work. The lead's current consent and preferences should stay visible and enforceable everywhere that data gets used.

Bringing Consent Into Your Real Estate Lead Management Stack

If your real estate business still manages lead consent as a scattered set of CRM checkboxes and spreadsheet notes shared with brokers, connecting that into one system is largely an integration exercise, not a rebuild. OneConsent helps real estate marketing, sales, legal and IT teams capture consent at every lead source and keep a single auditable history through the sales cycle. It also propagates withdrawal to CRM, campaign and partner systems automatically. Learn more on the OneConsent platform and book a live demo to see how consent enforcement can work across your lead sources, WhatsApp campaigns and channel partner network.