Real-estate businesses collect large volumes of enquiry data - often from portals, ads and walk-ins - and share it with sales teams and channel partners.
Typical risks
- Leads bought or received from portals without a clear notice.
- Sharing buyer details with partners or banks without defined purposes.
- Calling or messaging people repeatedly with no way to opt out.
- KYC and ID documents stored in chat apps or personal devices.
Practical steps
- Give a short notice at every capture point (form, call script, site-visit register).
- Record the source and purpose of each lead.
- Set retention for cold leads and delete or anonymise them.
- Register partners and CRMs as processors/recipients with contracts.
Frequently asked questions
Can I keep calling old enquiries?+
Only for purposes the person was told about and, where consent is the ground, while consent stands. Offer an easy opt-out and honour it.
Relevant provisions
- Section 5Rule 3 · pending verificationPrivacy notice at or before collection
- Section 6(1)-(3)Valid consent for processing
- Section 8(2)Processors engaged under valid contract
- Section 8(7)Rule 8 · pending verificationErasure when purpose is served or consent withdrawn
Official sources
Legal reviewPending legal review · drafted 19 Oct 2026
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.