Real Estate and Proptech: A DPDP Act Impact Study

Executive summary

Property is sold and let through a chain of hands. A flat-hunter's number moves from a listing portal to a broker, a developer's call centre, channel partners and loan agents. A tenant sends Aadhaar and salary slips to a broker on WhatsApp. A visitor gives her name at a gate while a camera records her face.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) reaches every link in that chain. Its drafters even used the sector as an example: illustration (II) to section 7(a) describes a woman who messages a real estate broker for help finding a rented flat. The broker may use her data to find and tell her about flats, and must stop when she says she no longer needs help.

Headline impact rating: High. Five of the twelve areas in the Trayambic scorecard are rated High. The three biggest changes are:

1. 1.The lead economy needs a lawful source. Bought and shared lead lists, owner-contact features and lead tagging between brokers and developers all need specific consent with an itemised notice. Telemarketing rules were tightened separately in February 2025.
2. 2.Public registers are not a free-for-all. Data a law requires to be published falls outside the Act. Allottee lists filed with a regulator, registry documents carrying fingerprints, and datasets that join public records to phone numbers do not.
3. 3.Buildings have become data systems. CCTV, visitor apps and biometric access need a lawful basis, security and deletion schedules, and the Act has no "legitimate interests" ground to fall back on.

The main obligations commence on 13 May 2027.

Background

Who this study covers

• Developers (promoters), with their sales teams, call centres and channel partners.
• Brokers and agents, from individual dealers to national brokerages.
• Listing portals and proptech platforms for sale and rent, and rental management apps.
• Property and facility managers, including rental managers for owners living abroad.
• Co-working and managed office operators.
• Residents' welfare associations (RWAs), touched on briefly.

Each is a data fiduciary (deciding why and how personal data is processed) for some activities and a data processor (acting for someone else) for others. The individual concerned is the data principal.

Whose data, and what data

The data principals are buyers and co-applicants, tenants and their families, individual landlords and sellers, visitors, domestic workers and delivery staff, residents, co-working members, and individual promoters and agents.

The data includes enquiries, site-visit records, identity documents (PAN, Aadhaar, passports of non-resident buyers), income documents for home loans, agreements and payments, tenant documents, CCTV footage, visitor logs and biometric templates.

Where it flows

A sale runs from the portal or campaign that produced the lead to the developer's CRM and call centre, channel partners who "tag" the buyer to claim commission, a lender, the sub-registrar, and later the facility manager and RWA. A rental runs through the portal, a broker, the landlord or property manager and the police. Much of it happens on WhatsApp.

Legal framework

The DPDP Act and Rules

• Grounds (ss.4, 6, 7): consent, or a legitimate use from the closed list in s.7. Section 7(a) covers data voluntarily provided for a specified purpose; s.7(d) covers legal duties to disclose information to the State; s.7(e) covers compliance with a judgment, decree or "order issued under any law"; s.7(i) covers employment purposes.
• Public data (s.3(c)(ii)): the Act does not apply to data made publicly available by the data principal, or by "any other person who is under an obligation under any law" to publish it.
• Notice and consent (ss.5, 6, Rule 3): itemised, specific and as easy to withdraw as to give.
• Fiduciary duties (s.8, Rules 6 and 7): responsibility for processors, security safeguards, breach intimation, and erasure when the purpose ends unless law requires retention.
• Children (s.9, Rule 12): no tracking or behavioural monitoring of children; the Fourth Schedule allows tracking a child's real-time location only in the interest of the child's safety.
• Large platforms (Rule 8): e-commerce entities with at least two crore registered users in India must erase data after three years without engagement.

Real estate law

• Real Estate (Regulation and Development) Act, 2016 (RERA). Project applications include "the names and photographs of the promoter" (s.4(2)(a)). The promoter keeps a web page on the authority's website "for public viewing", with quarterly lists of units booked (s.11(1)); the authority keeps a public website of project records (s.34(b)). Agents must register (s.9(1)), keep prescribed books, records and documents (s.10(b)) and avoid unfair trade practices (s.10(c)).
• State practice varies. Bihar's quarterly progress report format asks for allottees' names, addresses, email and phone numbers once more than half the units are booked, noting these details "may not be available to common people". MahaRERA Order 43/2023 (13 February 2023) requires agents to publish half-yearly reports of the transactions they facilitated, by project, unit and date, with only the fee withheld.
• Prevention of Money-laundering Act, 2002 (PMLA). Real estate agents "as may be notified" and the Inspector-General of Registration are designated businesses (s.2(1)(sa)). Agents with annual turnover of ₹20 lakh or more are reporting entities, regulated by the CBIC (since December 2020) through its Directorate General of Audit. They must carry out due diligence, report suspicious transactions within seven working days, keep records for five years (s.12) and not tip off clients.
• Registration Act, 1908. Buyers' and sellers' photographs and fingerprints are affixed to transfer documents (s.32A). Book 1, the register of documents relating to immovable property, is "open to inspection by any person applying" on payment of fees (ss.51, 57). The draft Registration Bill, 2025 (May 2025) would allow consent-based Aadhaar authentication with alternatives and keep public inspection; the Department of Land Resources still lists it as a draft.
• Land records. Under the Digital India Land Records Modernization Programme, parcels receive a 14-digit Unique Land Parcel Identification Number (ULPIN).

Tenancy, policing and buildings

• Model Tenancy Act, 2021 (approved by the Union Cabinet on 2 June 2021). By July 2022, the Ministry of Housing and Urban Affairs (MoHUA) reported that Andhra Pradesh, Tamil Nadu, Uttar Pradesh and Assam had revised their tenancy laws on its lines. MoHUA's draft model rules require online intimation of tenancy agreements to a Rent Authority, but say the details "shall not be accessible to public or any unauthorised person".
• Tenant verification. District magistrates and police commissioners can require landlords to give tenants' details to the police by orders under s.163 of the Bharatiya Nagarik Suraksha Sanhita, 2023; South Goa's July 2024 order is an example. The Delhi Police publishes a standard tenant verification form.

Consumer and telecom rules

• Consumer Protection Act, 2019. "Service" includes housing construction (s.2(42)); "e-commerce" means buying or selling goods or services over a digital network (s.2(16)); disclosing personal information given in confidence is an unfair trade practice unless law allows it (s.2(47)(ix)).
• Consumer Protection (E-Commerce) Rules, 2020: a grievance officer, acknowledgement within 48 hours and redress within a month (rules 4(4), 4(5)), and consent only by explicit affirmative action (rule 4(9)). Portals brokering rentals and services are likely e-commerce entities.
• TRAI Telecom Commercial Communications Customer Preference Regulations, 2018, as amended on 12 February 2025. Telemarketing may not use ordinary ten-digit numbers. After five complaints in ten days, an unregistered sender loses outgoing services for 15 days; repeat offenders are disconnected for a year and blacklisted. A sender may not seek consent again for 90 days after an opt-out.

How the layers fit

Section 38 makes the DPDP Act additional to these laws and lets it prevail in a conflict; s.16(2) preserves stricter sector limits on transfers abroad, though few apply here. Most rules here either require disclosure (RERA, PMLA, police orders) or require records (agent books, PMLA retention). The first group maps to s.3(c)(ii), s.7(d) or s.7(e); the second justifies retention under s.8(7). None of them authorises marketing.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

The lead economy

The statutory illustration is useful because it is narrow. A person who asks a broker for help finding a flat has provided her data for that search. The broker may send her listings, and must stop when she says she no longer needs help.

It does not cover what usually happens next:

• Passing her number to other brokers to widen the search, or to a developer for a new launch.
• Lead tagging. A channel partner registers a buyer with a developer to secure its commission. That is a disclosure from one fiduciary to another, for the partner's benefit, and needs her consent.
• Cross-selling to loan agents, interior designers and packers.
• Reusing old enquiries for later projects.

Each needs specific consent preceded by a Rule 3 notice naming the data and purpose. Consent to share with "the platform and its partners" is unlikely to be specific enough.

Portals face the same question with owners. An owner who lists a flat makes her number reachable through the portal. Selling access to it to brokers, or letting brokers call an owner who chose "no brokers", is a purpose she may not have accepted. The listing notice should say exactly who can reach her.

Bought lead lists are the weakest link. The buyer of a list becomes a fiduciary and needs its own ground; the seller's warranty does not supply one. From May 2027, a developer that cannot show how a number was obtained should not call it. If it does, the TRAI rules apply as well.

Public records and private profiles

Section 3(c)(ii) excludes personal data published by someone legally obliged to publish it. RERA requires project details to be available for public viewing on the authority's website. Where state rules put a promoter's or director's name there, a proptech displaying or analysing it is outside the Act for that data.

The exclusion is narrower than it looks:

• Filed is not published. Bihar's allottee lists are filed under a legal duty, but the form itself says they may not be public. The developer's filing arguably fits s.7(d). Anyone copying them from a portal cannot rely on s.3(c)(ii).
• Inspection is not publication. Registered sale deeds can be inspected by any applicant who pays the fee, and carry photographs and fingerprints. In Trayambic's view, a record one must apply to inspect is not obviously "publicly available"; bulk extraction of registry records to build owner profiles should be treated as processing personal data.
• Combining creates new data. A dataset joining registry names, ULPIN parcels and RERA unit details to phone numbers from elsewhere is new personal data, and its builder is a fiduciary.
• Agent reports. MahaRERA's agent reports list units and dates, not buyers. Linked with registry data they can identify buyers; firms should not try.

Buildings that watch

Housing societies, office towers and co-working centres commonly run CCTV, visitor apps and biometric gates. The personal or domestic exclusion does not help an RWA, developer or operator, and the Act has no "legitimate interests" ground.

• Staff: s.7(i) covers employment purposes, including safeguarding the employer from loss.
• Visitors: a visitor who gives her name and number at the gate has provided them for entry, which fits s.7(a). Photographing her or keeping her number for marketing does not.
• CCTV: a camera records people who provide nothing, and signage informs without being "clear affirmative action". Elsewhere the Act offers no clean ground for recording passers-by; until the Board addresses it, limit cameras to entrances and common areas, give clear notice and keep footage briefly.
• Biometrics: co-working members are not the operator's employees, so s.7(i) is unavailable and fingerprint or face entry rests on consent. Section 6(1) requires that consent to be "free", which is hard to show if the turnstile accepts nothing else.
• Children: a gate app that alerts parents when a child leaves is close to the Rules' permitted real-time location tracking for safety. A permanent movement history goes further and risks s.9(3).

Worked example (illustrative): a rental and property management firm

A firm in a large city manages about 1,500 flats, many for owners living abroad. It advertises on two portals, collects tenant documents on WhatsApp, files police verification forms and leave-and-licence agreements, and runs a maintenance app. From 13 May 2027:

• Enquiries. Using a seeker's data to show flats fits s.7(a). Passing her number to partner brokers, or adding her to a newsletter, needs consent.
• Roles. For flats it fully manages, the firm decides most purposes and means, so it is a fiduciary in its own right, not merely the owner's processor. The management agreement should say so.
• Tenant documents. Aadhaar, PAN, employer letters and photographs move from personal chats into an access-controlled document system, with Aadhaar numbers masked where only identity needs showing.
• Police verification. Submitting tenant details under a local order fits s.7(e). Sending more than the form asks for does not.
• Owners abroad. Section 17(1)(d) exempts processing of data of people outside India under a contract with a person outside India. Read literally, it may reach an overseas owner's own data, never the tenants'. The firm should not build its programme on it.
• Breach. An executive loses a phone holding tenant documents for 40 flats. The Board must be told without delay and receive a detailed report within 72 hours; each tenant must be told what was exposed and what to watch for, such as loans taken out in their names.
• Retention. Tenant documents go once the tenancy ends and any deposit dispute closes, unless law requires longer. If the firm also brokers sales and its turnover reaches ₹20 lakh, PMLA records must be kept for five years.

Compliance framework

Checklist

Roadmap to 13 May 2027

Now to December 2026. Name a DPO or responsible person. Map lead sources and data flows. List every channel partner and vendor. Stop buying lead lists without provenance.

January to March 2027. Rebuild forms, listing flows and site-visit registers. Amend contracts. Move documents off messaging apps. Review building systems with RWAs and facility managers.

April to May 2027. Publish notices and the retention schedule. Purge stale data. Test the breach plan on a lead-list leak. Open the rights channel.

Ongoing. Re-check lead sources before each launch. Track state RERA, tenancy and CCTV rules, and any Board guidance on CCTV and public data.

Recommendations

1. 1.Use the broker illustration as the baseline: data from an enquiry serves that enquiry, and stops when the client says so.
2. 2.Make lead provenance a condition of every campaign. No source, no call.
3. 3.Get consent before tagging a buyer with a developer, and require it in channel partner agreements.
4. 4.Do not treat registries as open data. Rely on s.3(c)(ii) only for data a law requires to be published.
5. 5.Take documents off personal messaging apps, which are hard to secure, audit or purge.
6. 6.Keep a non-biometric way in for anyone who will not consent, and set documented retention periods for footage and visitor logs.
7. 7.Write roles into contracts: who is the fiduciary for the buyer, the tenant and the owner at each step.

Trayambic's e-commerce impact study covers marketplace obligations, and its blog on dark patterns covers interface design, in more detail.

Key takeaways

• Real estate and proptech rate High on the Trayambic scorecard, with five of twelve areas rated High.
• The DPDP Act's own broker illustration sets the baseline: enquiry data serves that enquiry and stops when the client says so; tagging, resale and cross-selling need consent.
• Section 3(c)(ii) excludes data a law requires to be published, such as RERA project pages, but not allottee lists filed with regulators or profiles built from registry records.
• CCTV, visitor apps and biometric access have no legitimate-interests ground to rely on; use s.7(a) and s.7(i) where they fit, and notice, alternatives and short retention elsewhere.
• Tenant documents should leave personal messaging apps before May 2027; a lost phone full of them is a notifiable breach.