DPDP Consulting for Real Estate
Learn how construction and real estate teams should handle worker biometrics, buyer KYC and site data.
Discuss this page with an LLM
Now replace the sandwich shop with your Construction company. Where does personal data enter? Where does it sit? Who else touches it?
Construction DPDP Self-Check
Start here to understand why DPDP is relevant to Construction. Before any other task, first understand how personal data moves through the business.
What is Construction?
In this context, Construction means the websites, apps, operations, support teams, customer records, employee systems, vendor tools and data workflows that collect or use personal data.
Children's data
- Do you collect age, class, school, parent details or learning progress?
- Can you separate child, parent and guardian data?
- Do you know which users are under 18?
Consent
- Can you prove where consent came from?
- Is consent collected before data is used for the stated purpose?
- Can consent be withdrawn without breaking the entire account flow?
Tracking and profiling
- Do you track usage, performance, attention, behavior or drop-offs?
- Is any of this used for ads, recommendations or nudges?
- Are analytics tools collecting user identifiers?
Vendors and SDKs
- Which CRMs, email tools, payment tools, analytics tools and support tools receive personal data?
- Do contracts say they process data only on your instructions?
- Can you delete or export data from each vendor?
Retention
- What happens when the service ends?
- What happens when a user leaves?
- What data is kept for certificates, invoices, disputes or regulatory records?
First action
- Map one user journey from sign-up to completion.
- Mark where data is collected, stored, shared, used for communication and deleted.
If this self-check exposed more than three unclear answers, the next useful step is a DPDP data journey map.
Book a DPDP clarity callConstruction Company Analyses
Housing.com
Housing.com's property search data reveals income brackets, family stage, geographic preferences, and investment capacity — shared with dozens of broker partners. At 42/100, the platform's broadcast model to real estate agents creates DPDP consent issues similar to PolicyBazaar's insurance model.
99acres (Info Edge India Ltd.)
99acres's privacy policy remains heavily anchored in the IT Act 2000 and the 2011 Privacy Rules. While it provides strong security disclosures, it fails major DPDP Act 2023 hurdles — specifically regarding granular consent, multi-language notice availability, and the specific rights of data principals (like nomination and DPB escalation). For a platform handling significant financial intent and PII, these gaps represent high regulatory risk.
MagicBricks
MagicBricks operates a high-volume platform handling sensitive financial and property data. Its current policy is a legacy document built for the IT Act 2000. It lacks the 'granular consent' and 'right to erasure' frameworks mandated by the DPDP Act 2023. The absence of an escalation path to the Data Protection Board of India (DPBI) and the lack of a 'Notice' in languages specified in the Eighth Schedule are significant compliance liabilities.
Frequently asked questions
Do I need consent to track laborers via GPS on the job site?
Yes, if the tracking identifies a specific person, you must provide a notice explaining why tracking is necessary for safety. You must also provide a way for them to withdraw consent, though this may affect their site access.
Can I share buyer lists with my other upcoming projects?
No, unless the buyer gave specific consent for future project marketing during the initial sale. You cannot use data collected for one project to sell units in a different development without a new consent notice.
How does DPDP affect my project handover to a Resident Welfare Association (RWA)?
When handing over buyer data to an RWA, you must limit the transfer to what is necessary for building management. You should document this transfer as a fulfillment of your original contract to avoid liability for how the RWA later uses that data.