DPDPA Compliance for Real Estate & PropTech in Goa

Real estate businesses collect buyer/tenant leads, identity and income documents, and routinely share them with brokers, banks and developers — often with no consent trail.

Goa context: A hospitality and tourism economy where guest ID and booking data retention is the key risk. The obligations below apply to real estate and proptech businesses operating in Goa, Goa — there is no local exemption and no turnover threshold under the DPDP Act.

DPDPA applies. Lead-sharing across brokers and channel partners makes consent and transfer documentation essential.

• Buyer/tenant contact & leads
• Identity & address proofs
• Income & loan documents
• Site-visit and CCTV data

• Lead lists sold/shared across brokers
• KYC documents on personal devices
• No consent for marketing calls
• CCTV without notice

• Consent for marketing and lead-sharing
• Notice at lead capture
• Processor contracts with brokers/banks
• CCTV signage and retention limits
• Erasure on request

• Cold-calling purchased lead lists
• Sharing leads without consent
• Indefinite KYC retention

• Add consent at every lead form
• Stop using purchased lead lists
• Put up CCTV notices
• Define lead retention/erasure rules

Can we call leads we bought from a vendor?

Not without a lawful basis and consent. Purchased lists rarely carry valid DPDPA consent.

Do we need CCTV notices?

Yes — visible notice and a defined retention period are expected.