DPDPA 2023 Compliance

Section 5 DPDPA Notice Template for Real Estate: 6-Item Checklist

12 August 2026 · DPDPAReady Editorial · ~5 MIN READ


Applies to	Real Estate Agencies & Property Management Companies operating in India
Primary law	DPDPA 2023 · Section 5
Penalty ceiling	up to ₹150 crore
Enforcement status	Data Protection Board accepting complaints — 2026-08
Source	DPDPAReady Compliance Team

Section 5 Notices Are Your First Line of DPDPA Compliance — And Most Real Estate Agencies Are Missing Them

Section 5 of the Digital Personal Data Protection Act, 2023 requires you to provide an itemised notice before or at the time of seeking consent to collect personal data. For real estate agencies, this means disclosing what data you collect (property details, buyer identities, financial information, site visit records), why you collect it, how long you keep it, and who else gets access to it — all before you ask a buyer or seller to sign anything.

Most Indian real estate agencies ask buyers and sellers to sign agreements or fill out contact forms without providing a separate Section 5 notice. They assume the privacy clause buried in page 4 of a 10-page agreement covers compliance. It doesn’t. Under DPDPA enforcement, this gap exposes you to penalties up to ₹150 crore.

A proper Section 5 notice isn’t a compliance checkbox — it’s the foundation of trust. It tells buyers and sellers upfront that you’re transparent about data handling.

What Section 5 Requires: The 6 Mandatory Disclosures

Section 5 of the DPDPA mandates that before or at the time of seeking consent, you must disclose:

Purpose of collection – Why you’re gathering the data
Category of personal data – What types (identity, financial, property, contact)
Rights available – The five statutory rights: access, correction, erasure, portability, withdrawal of consent, plus grievance redressal
Name and contact of grievance officer – The person data subjects can reach with complaints
Data retention period – How long you keep the data
Sharing details – Whether data goes to third parties (banks, lawyers, co-brokers, government)

For real estate, this specificity matters. Buyers need to know their Aadhaar will be shared with lenders. Sellers need to know property photographs will go to your portal and co-brokers. Property valuers need to know site visit records are retained for 7 years because of title disputes.

The Section 5 Notice Template for Real Estate: Fill-in-the-Blank

Copy this template. Customize the bracketed sections with your agency details. Issue it to every buyer and seller before collecting personal data — at the first inquiry, at the listing meeting, or when they provide identity documents.

NOTICE UNDER SECTION 5, DIGITAL PERSONAL DATA PROTECTION ACT, 2023

Data Fiduciary (Real Estate Agency): [Your Agency Name]
Registration/License Number: [RERA Registration Number]
Registered Office: [Full Address]
Email: [Agency Email]
Phone: [Agency Phone]
Date of Notice: [Date]

1. PURPOSE OF DATA COLLECTION

We collect your personal data for the following purposes:

Property listing, promotion, and sale/rental facilitation
Buyer-seller matching and transaction coordination
Verification of identity and financial capacity
Legal compliance (GST, stamp duty, property registration)
Credit verification and lender coordination (if mortgage involved)
Property valuation and site inspection documentation
Government registration filing (MahaReg, ICAI, municipal records)
Grievance redressal and customer follow-up
Tax compliance and record-keeping

2. CATEGORY OF PERSONAL DATA BEING COLLECTED

We collect the following categories of personal data:

Identity Information:

Full name, PAN, Aadhaar, passport, driver’s license, voter ID

Contact Information:

Residential address, phone number, email address, WhatsApp contact

Financial Information:

Bank account details (if payment involved)
Income proof, salary slips, financial statements
Property value, mortgage amount, lender name
Payment history and receipts

Property Information:

Property address, legal description, property ID
Property photographs, videos, floor plans
Legal documents (deed, registered title, tax receipts)
Encumbrance Certificate, approved building plan
Site inspection records and visit dates
Valuation reports

Transaction Records:

Offers made and negotiations
Agreements signed (LOI, booking, sale deed)
Payment receipts and bank transfer records
Registration application status

Communication Records:

Email exchanges, SMS records, call logs (if call recording exists)
WhatsApp chat history with buyers/sellers

3. RIGHTS AVAILABLE TO YOU (SECTION 5 MANDATORY DISCLOSURE)

You have the following rights under the Digital Personal Data Protection Act, 2023:

Right to Access (Section 10): You can request a copy of all personal data we hold about you, including property documents and transaction records.
Right to Correction (Section 11): You can request that we correct inaccurate or incomplete data (e.g., wrong address, misspelled name).
Right to Erasure (Section 12): You can request deletion of your personal data, subject to legal retention requirements. After a transaction closes, we will delete non-essential data except where required by law (7-year retention for property title records).
Right to Data Portability (Section 11): You can request your data in a portable, machine-readable format (e.g., PDF, CSV) to transfer to another agency or portal.
Right to Withdraw Consent (Section 7): You can withdraw consent for data processing at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to Grievance Redressal (Section 12): You can lodge a complaint if you believe we have violated your data rights.

4. GRIEVANCE OFFICER CONTACT

To exercise any of the above rights or lodge a complaint, contact:

Name: [Grievance Officer Name]
Designation: Data Protection Officer / Compliance Manager
Email: [grievance@youragency.com]
Phone: [Phone Number]
Office Address: [Full Office Address]
Response Commitment: We will acknowledge your request within 10 days and respond with action within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India at www.dataprotectionboard.in (operational status: May 2026).

5. DATA RETENTION PERIOD

Active listing/transaction data: Retained for the duration of the property listing and 12 months after transaction closure or listing expiry.
Identity and financial documents: Retained for 7 years to comply with Indian stamp duty laws (State Land Revenue Acts) and property registration requirements (Registration Act, 1908).
Payment receipts and bank transfers: Retained for 7 years for GST and income tax compliance.
Site inspection records and photographs: Retained for 5 years for valuation audits and dispute resolution.
Contact information for follow-up: Retained for 2 years after the last transaction. You may opt out of follow-up communications at any time.
Call recordings (if any): Deleted after 90 days unless a dispute exists, then retained for 2 years.

After the applicable retention period, your data will be permanently deleted or anonymised, unless:

We have a legal obligation to retain it (property title records, tax records)
A dispute or claim exists
You have authorized extended retention

Your personal data may be shared with the following third parties for the purposes listed:

Government Authorities:

Municipal Corporation, State Land Revenue Department (for property registration)
Income Tax Department (for GST and property value compliance)
RERA (Real Estate Regulatory Authority) — if mandated in your state

Financial Partners:

Banks and Non-Banking Finance Companies (for loan verification and disbursal)
Credit bureaus (for credit rating checks)

Legal & Title Partners:

Lawyers and legal advisors (for contract review and dispute resolution)
Title search firms (for property encumbrance verification)

Property Sales Partners:

Co-brokers and partner agencies (for property circulation, only if you authorize)
Property portals (99acres, MagicBricks, Housing.com) — if property is listed

Operational Partners:

CRM and property management software providers
Cloud storage providers (Google Drive, Dropbox, Microsoft OneDrive)
Email and communication platforms

Your data will NOT be:

Sold to unrelated third parties
Used for marketing purposes without your explicit consent
Shared with mortgage brokers or insurance agents without your authorization

For co-broker sharing, we obtain your written consent separately. For portal listings, we disclose property details and your contact info only to serious inquiries with your authorization.

7. LANGUAGE AVAILABILITY (EIGHTH SCHEDULE, CONSTITUTION)

This notice is provided in English. If you require this notice in Hindi, Marathi, Gujarati, or any other Eighth Schedule language, please request it and we will provide it within 7 days.

How to Implement This Template in Your Agency

Step 1: Customize the 7 Sections

Section 1 (Purpose): Remove or add purposes that don’t apply. If you don’t verify credit, remove it. If you also handle property management, add it.
Section 2 (Data Categories): Adjust based on what you actually collect. If you don’t collect voice/video, remove it.
Section 5 (Retention): Align with your agency’s document retention policy and Indian property law (7 years is standard for deed records).
Section 6 (Sharing): List only the actual third parties you work with. If you don’t use 99acres, don’t list it.

Step 2: Designate a Grievance Officer

Name a real person — owner, manager, or compliance officer.
Provide a monitored email and phone number.
Ensure the person can respond to deletion requests, access requests, and complaints within 30 days.
For smaller agencies (1–5 people), the owner can serve as the grievance officer.

Step 3: Issue Before Collecting Data

Provide the notice to every buyer and seller at the first interaction — whether in person, email, WhatsApp, or SMS.
If a prospect calls without prior notice, send the notice via email/SMS immediately and confirm they have read it before discussing property.
At the first in-person meeting, have them sign or acknowledge the notice digitally.
For walk-in inquiries, keep printed copies at reception and request signature before taking details.

Keep a record (digital or paper) linking the buyer/seller’s name to the date they received and acknowledged the notice.
A WhatsApp message saying “I agree,” a Google Form response, or an email confirmation counts as written acknowledgment.
Do not proceed to collect data (Aadhaar, PAN, property preferences) before consent is documented.

Step 5: Handle Deletion Requests

If a buyer or seller requests erasure of their data, delete from:
- Your CRM system
- Cloud storage (Drive, Dropbox)
- Email archives (or anonymise)
- Co-brokers (send written request to delete)
- Any portal you uploaded their contact to
Document the deletion in writing and confirm to the requester within 30 days.
Retain records of the deletion for 12 months for audit purposes.

Real Estate-Specific Compliance Pitfalls

Many agents share buyer/seller mobile numbers with co-brokers to circulate properties. Section 5 requires you to disclose this upfront. If your notice says “Your contact may be shared with co-brokers,” and the buyer doesn’t object, you have consent. If the notice is silent and you share anyway, you violate Section 5.

Fix: Add a checkbox in your notice: ”☐ I authorize my contact details to be shared with co-brokers for property circulation.”

When a buyer asks about loan options, you may collect financial documents and share them with banks. This is sharing with “Data Fiduciaries” (banks are independent controllers). Section 5 requires upfront disclosure that financial data will go to lenders.

Fix: Section 2 and Section 6 must explicitly state: “If you inquire about mortgage options, your financial data will be shared with banks and NBFCs for credit verification.”

Uploading property photos and descriptions to 99acres or MagicBricks means the property address and seller details are visible to thousands of unknown users. Some sellers don’t realize this level of circulation.

Fix: Get written consent for “portal listing.” Add a line: “Your property address, photographs, and contact details will be published on property portals (99acres, MagicBricks, Housing.com) to attract buyers.”

4. Call Recording Without Notice

If your agency records client calls for training or dispute resolution, this is collection of voice biometric data. Section 5 requires you to disclose this and retain records only as long as necessary (90 days for QA, 2 years if a dispute exists).

Fix: Add to Section 2: “If you communicate with us via phone, your voice may be recorded. Recordings are retained for 90 days for quality assurance and deleted unless a dispute exists.”

5. Seven-Year Retention Confusion

Property law requires you to retain deed documents for 7 years. But Section 5 requires you to disclose this. Many agencies don’t explain why they need such long retention, making buyers suspicious.

Fix: Section 5 must state: “We retain property deeds and transaction records for 7 years to comply with Indian stamp duty and property registration laws. After 7 years, we delete unless a dispute is pending.”

Audit Checklist: Section 5 Compliance for Real Estate

Before you issue your notice, run through this checklist:

Frequently Asked Questions

Q1: Do I issue one Section 5 notice per property listing, or one per buyer/seller?

A: One notice per buyer/seller is best practice. However, you may use a master agency notice that applies to all your data collection, provided it covers all purposes and data categories you use. If you use a master notice, display it prominently on your website, in your office, and provide a copy at the first interaction. The master notice applies to all transactions unless you have a specific exception (e.g., “For this luxury property, we will not list on portals” — document that exception).

Q2: Can I include the Section 5 notice inside my buyer/seller agreement instead of issuing it separately?

A: No. Section 5 requires the notice to be provided before or at the time of seeking consent. If you bury it on page 7 of a 12-page agreement that the buyer hasn’t read, you haven’t provided adequate notice. Best practice: issue the Section 5 notice first (via email or in person), get acknowledgment, then issue the buyer agreement. If you combine them, ensure the notice appears on the first page in clear, readable font (at least 11pt) before any terms or checkboxes.

Q3: A buyer filled out my contact form on my website without seeing the Section 5 notice. Am I compliant?

A: No. Any data collected without prior notice violates Section 5. You must:

Immediately send the buyer a Section 5 notice via email
Request fresh consent acknowledging the notice
Document their confirmation
For new website visitors going forward, display the notice on the form page or as a pop-up before they enter any data

Retroactive notices don’t cure violations. Future compliance requires notice-first, data-collection-second.

Q4: We use a CRM (like Salesforce or Zoho) to manage buyer data. Who issues the Section 5 notice — us or the CRM vendor?

A: You (the real estate agency) are the Data Fiduciary and must issue the notice. The CRM vendor is a Data Processor. Your Section 5 notice should disclose: “Your data is processed via [CRM platform name] for managing inquiries and property matching. [CRM vendor] is bound by a data processing agreement and will not use your data for any purpose other than supporting your transaction with us.”

You are liable if you fail to issue the notice; the CRM vendor is not. Ensure your CRM agreement includes data processing clauses per DPDPA Section 8.

Q5: What penalty applies if we fail to issue a Section 5 notice, and when might it be enforced?

A: Failure to provide a Section 5 notice is a direct violation. Penalties under Section 12 for notice-related breaches can reach up to ₹150 crore, though smaller agencies typically face lesser penalties proportionate to violation severity, number of affected data subjects, and intent. The enforcement timeline: Data Protection Board is operational as of May 2026 and accepting complaints. Penalties are assessed based on complaint severity and repeat violations. The best defense is immediate compliance — issue notices to all current buyers/sellers and new prospects going forward. If a complaint arrives, you’ll have documented evidence of remediation.

Section 5 DPDPA notice real estateproperty data disclosure notice Indiareal estate grievance officer noticeDPDPA Section 5 templateproperty agent consent noticereal estate buyer seller data

VERIFIED • DPDPAReady Editorial Desk • 12 AUG 2026

Not sure if your media workflow is DPDPA-compliant?

DPDPAReady maps your entire workflow against the Act — free, in 48 hours.

Get your free compliance audit →