India's data protection law is arriving in phases, TRAI already polices promotional calls, and WhatsApp has its own opt-in rule. What applies today, what starts in 2027, and how to fix your lead list.
Under the DPDP Act, 2023 an agent is a Data Fiduciary and each client a Data Principal. Its consent, notice, security and erasure duties commence in mid-May 2027. TRAI's rules on promotional calls and SMS already apply, and WhatsApp's policy already requires opt-in. Bought lists fail all three tests.
RERACertified™ Professional (RCP) covers the RERA Act, your state track and professional duties around client documents and data. RERACertified sells this course. RCP is a private certification and does not replace state RERA agent registration.
See RERACertified™ Pro — ₹4,999 →| Question | Short answer (5 Nov 2026) |
|---|---|
| Who is who | You or your firm: Data Fiduciary. Your client: Data Principal. |
| Core duties in force? | Not yet. They commence 18 months after the Rules: mid-May 2027. |
| Promotional calls and SMS | TRAI's TCCCPR 2018, as amended in 2025. In force now. |
| WhatsApp marketing | WhatsApp policy requires opt-in now. Platform rule, not law. |
| Highest DPDP penalty | Up to ₹250 crore for failing to take reasonable security safeguards. |
| Bought lead lists | No opt-in, no consent to you. Do not use for outreach. |
Yes. "Personal data" is any data about an identifiable individual (Section 2(t)): a name with a number, a budget note, a PAN copy. Confirmed
Section 3(c) excludes personal or domestic use, and data the person made public themselves. A brokerage is not personal use, and the "public" exclusion is untested for scraped portal numbers; TRAI's and WhatsApp's rules apply regardless.
The Act dates from 11 August 2023 but switches on in stages. The DPDP Rules, 2025 were published in the Gazette on 13 November 2025 (G.S.R. 846(E)) and set the stages in Rule 1. Confirmed
| From | What commences | Status today |
|---|---|---|
| 13 Nov 2025 | Definitions, the Data Protection Board (Sections 18–26), rule-making; Rules 1, 2, 17–21. | In force |
| One year later (13 Nov 2026) | Consent Managers: Section 6(9), Section 27(1)(d) and Rule 4. | Days away |
| 18 months later (mid-May 2027) | Sections 3–17 (notice, consent, legitimate uses, duties, rights), penalties (27–34), 44(2); Rules 3, 5–16, 22, 23. | Not yet in force |
Section lists as summarised by law firms Reported; some count 12 Nov 2026 and 12 May 2027. MeitY was reported in early 2026 to be consulting on cutting 18 months to 12 Reported; we found no notified change. Verify on meity.gov.in.
Meanwhile Section 43A of the IT Act, 2000 (compensation for negligent handling of sensitive personal data by a body corporate) stays in force until Section 44(2) omits it.
Section 4 allows processing only for a lawful purpose (one not expressly forbidden by law), and only on one of two grounds: the person's consent, or a "certain legitimate use" under Section 7. Confirmed
Section 6(1): consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, limited to the data needed. A pre-ticked box is not that. Section 5 requires a notice with or before the request: what data and why, how to withdraw and use rights, and how to complain to the Board. Section 6(3) requires plain language, in English or an Eighth Schedule language. Section 6(4) makes withdrawal as easy as giving consent.
Section 7 lists nine. For a broker, usually only 7(a) matters: processing for the specified purpose for which the person voluntarily provided their data, unless they object. A buyer who enquires about a named project, or hands you a PAN to book, fits. The rest cover State functions, legal duties to the State, court orders, medical emergencies, epidemics, disasters and employment. None covers marketing.
The Rules add a stand-alone, plain-language notice Confirmed; safeguards such as encryption or masking, access control, logs and backups, with logs kept a year Reported; and breach reports to affected people without delay, with a detailed report to the Board within 72 hours Reported. Rights requests: 90 days. Confirmed
| Breach | Maximum penalty |
|---|---|
| No reasonable security safeguards (8(5)) | ₹250 crore |
| Not notifying a breach (8(6)) | ₹200 crore |
| Children's data obligations (Section 9) | ₹200 crore |
| Significant Data Fiduciary obligations (Section 10) | ₹150 crore |
| Breach of a Data Principal's duties (Section 15) | ₹10,000 |
| Any other provision of the Act or Rules | ₹50 crore |
These are ceilings, set by the Board after an inquiry. Section 33 makes it weigh gravity, duration, data type, mitigation and proportionality. Nobody should claim a small agent "will be fined ₹250 crore", but sloppy security is the costliest line. Confirmed
| Practice | Don't | Do |
|---|---|---|
| Buying lead lists | Buy "HNI buyer data" and call or broadcast. | Build your own leads via forms with a notice and opt-in. |
| Scraping portal numbers | Copy portal numbers into a campaign sheet. | Reply through the portal's own enquiry system. |
| WhatsApp groups | Add people to a group without asking. | Ask first, then send an invite link. |
| Broadcast lists | Broadcast to every phone contact. | Broadcast only to opted-in contacts, with a STOP line. |
| Sharing Aadhaar/PAN with builders | Forward KYC to sales groups or several builders. | Only the booking builder, only what its form needs, with the client's knowledge. |
| Storing KYC on phone | Leave Aadhaar images in chats and photo backup. | One locked folder; delete chat copies; screen lock on. |
| After the deal | Keep everything forever. | Keep what Section 10(b) and tax rules require; erase the rest. |
| Calling from your mobile | Cold-call campaigns from a 10-digit number. | Call about their own enquiry; promotions via registered channels. |
Where the full Aadhaar number is not needed, ask the client for a masked Aadhaar, which UIDAI offers as a download showing only the last four digits Reported. Fewer full ID numbers on your phone means less to lose.
Templates, not legal drafting: have a lawyer review your final version.
A few questions on your experience and goals; it suggests Associate, Pro or neither. Free, no sign-up.
Take the course-fit quiz →Rohit, a Zirakpur channel partner, wants to message his "5,000-number list" about a launch. He sorts it by source first (illustrative figures).
| Segment | Numbers | What he can do |
|---|---|---|
| Own website and ad enquiries, with his opt-in checkbox | 1,200 | Message them, with a STOP line. |
| Past clients and site visitors, no written opt-in | 800 | One message asking if they want launch updates; only YES replies join. |
| Bought from a "data vendor" in 2024 | 2,500 | No opt-in, no consent, and cold-calling breaches TRAI rules. Delete. |
| Copied from portal listings and group chats | 500 | Do not contact. Delete. |
| Total | 5,000 | Usable now: 1,200, plus any of the 800 who reply YES. |
If 300 of the 800 reply YES, his real list is 1,500 people who asked to hear from him. The 3,000 he deleted were the likeliest to block him, report him and file TRAI complaints, and his opt-in log answers any "I never agreed". When a buyer books, KYC goes only to that developer's booking desk, chat copies are deleted, and deal records are filed as Section 10(b) requires.
| Untrained agent says | Trained agent knows |
|---|---|
| "The DPDP Act is fully in force, so I'm already in trouble." | Core duties commence in mid-May 2027. TRAI's rules and WhatsApp's policy apply now. |
| "They enquired once, so I can message them forever." | Section 7(a) covers the purpose they gave the data for. New projects need an opt-in. |
| "I paid for this list, so I can use it." | Paying a vendor does not give you anyone's consent. |
| "I'll send the Aadhaar to all three builders." | Share only with the builder being booked, only what its form needs. |
| "Delete everything when the client asks." | Erase what is no longer needed, but keep records the law requires, such as RERA Section 10(b) files. |
It fits duties you already have: a buyer tricked into a broadcast list rarely trusts the rest of your advice. See RERA Sections 9 and 10: agent duties and, for team rollouts, RERA training for brokerage firms.
RERACertified™ Pro covers the RERA Act, your state track and the duties that come with client documents and data.
Enroll in RERACertified™ Pro — ₹4,999 →RERACertified sells this course. RERACertified™ Pro is a private certification and does not replace state RERA agent registration.