DPDP Guide for PropTech Platforms
PropTech platforms process sensitive financial and property data. Learn how Indian real estate firms must handle KYC and lead data under DPDP.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Guide for PropTech Platforms, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Financial and Identity Data Risks
Real estate platforms collect more than just names and phone numbers. They process PAN cards, bank statements, and salary slips for home loan eligibility. This data provides a complete financial map of a user. Under DPDP, you must limit access to these documents. A sales agent viewing a lead does not need access to that lead’s uploaded bank statements unless their specific job is loan processing.
Third-Party Lead Sharing
Most PropTech platforms act as a bridge between buyers, brokers, and developers. When you pass a lead to a third-party developer, you are responsible for how that data was shared. You must have a contract that prevents the developer from using that lead for unrelated projects. If a user withdraws consent on your platform, you must notify every broker or developer who received that data to delete it immediately.
Data Types in PropTech Workflows
| Work Area | Data Processed | DPDP Risk Level |
|---|---|---|
| Lead Generation | Phone, Email, Budget, Location | High |
| KYC & Verification | PAN, Aadhaar, Income Proofs | Very High |
| Seller Listings | Property Titles, Home Address, Photos | Medium |
| Site Visit Apps | Visitor Photos, Car Plate Numbers | High |
| Tenant Screening | Employment History, Previous Addresses | Very High |
The Retention Conflict
Real estate has a long sales cycle, often lasting years. Many platforms keep “cold leads” indefinitely to send newsletters or new project alerts. DPDP forbids this. Once a user decides not to buy or requests to be left alone, the purpose of collection is over. You cannot retain their financial profile or contact info for “potential future interest” unless they specifically opt-in to a long-term marketing database.
This week
Map the journey of one “Buy” inquiry from your website to your CRM and finally to the external broker. List every person and third-party software that can see the buyer’s phone number and financial documents.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Do we need consent to display a property owner's phone number on our portal?
Yes. Even if a broker provided the number, the platform must ensure the owner gave specific consent for their contact details to be published online for lead generation.
How long can we keep lead data if the person does not buy a property?
You must delete the data once the specific purpose for collecting it ends. If a user stops interacting with your platform, you cannot keep their financial profile for future marketing without new consent.
Is a photo of a visitor at a construction site office considered personal data?
Yes. Any image that can identify a natural person is personal data. You must inform visitors why the photo is being taken and how long it will be stored.