Short answer: Buying a real estate leads database in India is legally risky and commercially weak. Under the DPDP Act, 2023 you become responsible for personal data you cannot prove was collected with consent for your purpose, with penalties up to ₹50 crore for most breaches and ₹250 crore for security failures. Calling the list with offers is promotional telemarketing, which TRAI rules restrict to registered 140-series numbers, and WhatsApp's policy forbids messaging people who have not opted in to hear from you. Most records are stale, shared or wrong anyway. The same money buys exclusive, consented enquiries through Meta, Google or Click-to-WhatsApp ads.
What do "real estate leads database" sellers actually sell?
Search for a real estate leads database and you will find offers like "HNI database Gurgaon", "property buyers data Pune with mobile numbers" or "NRI investor list". These are usually one of the following:
| What it is called | Where it usually comes from | The problem |
|---|---|---|
| "Verified property buyers" | Old portal or ad enquiries resold by brokers, agencies or ex-employees | The person consented to one business, not you; often years old |
| "HNI / high-income database" | Compiled from credit card, bank or car-ownership leaks, or scraped directories | Possibly stolen data; no property intent at all |
| "Exhibition visitor list" | Property expo registrations | Consent was for the event organiser, not every exhibitor |
| "Society / apartment residents data" | RWA directories, delivery apps, scraped listings | No consent, no intent; high complaint risk |
| "Fresh leads daily" | Shared lead streams sold to many buyers | Same person called by several sellers within hours |
The supply chain is real and has been prosecuted. In 2023, Cyberabad police arrested a man for selling personal data of about 66.9 crore individuals and organisations in 104 categories; reporting by The News Minute described bank, card and app-user data among them, and said the main buyers were advertising and marketing agencies. A buyer of such a list cannot tell whether it is old enquiry data or stolen data, which is the core of the risk.
Is buying a property leads database legal under the DPDP Act?
The Digital Personal Data Protection Act, 2023 does not ban buying data by name, but it makes using a bought list very hard to defend:
- Consent must be specific to your purpose. Section 6(1) requires consent that is "free, specific, informed, unconditional and unambiguous with a clear affirmative action". A buyer who agreed to hear from one developer about one project has not consented to your calls.
- You become the Data Fiduciary. Whoever decides the purpose and means of processing (Section 2(i)) is responsible for compliance, including for anything a vendor or call centre does on its behalf (Section 8(1)).
- Erase when the purpose ends or consent is withdrawn. Section 8(7) requires erasure on withdrawal or once the purpose is no longer served, which cuts against keeping and re-selling old lists.
- Penalties are large. The Schedule allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to report a breach, and ₹50 crore for breaches of other provisions.
On timing: the DPDP Rules were announced on 14 November 2025 with an 18-month phased timeline; the notice, consent, security and data-principal-rights rules apply from 13 May 2027. That is not a reason to buy now. Data you collect or acquire today will still be on your systems when the obligations apply, and you will need to show where each record came from.
What do TRAI rules say about calling or SMSing purchased leads?
Calling a stranger about a project is promotional communication under TRAI's Telecom Commercial Communications Customer Preference Regulations. The February 2025 amendment tightened them:
| Rule | What it means for a bought list |
|---|---|
| Promotional calls only from the 140 series; normal 10-digit numbers barred for telemarketing | Sales reps dialling a list from mobile SIMs is unregistered telemarketing |
| Action against a sender after 5 complaints in 10 days (earlier 10 in 7) | A few annoyed recipients can trigger action |
| Customers can complain about unregistered senders without being on DND, within 7 days | Everyone on the list can complain, not only DND users |
| First violation: outgoing services barred on all the sender's telecom resources for 15 days; repeat: disconnection for one year and blacklisting | You can lose your sales team's numbers, including SIP trunks |
| 90-day wait before re-requesting consent after an opt-out | Opted-out people cannot be re-asked straight away |
TRAI's July 2026 clarification confirms that entities in every sector must use registered 140xx numbers for promotional calls, and that customers can block promotional calls by sector through the DND registry, in which case they are not delivered. Bulk SMS needs entity, header and content template registration on the DLT platform, so an unregistered SMS blast to a list simply fails or exposes you.
Can you upload a bought list to WhatsApp or ad platforms?
WhatsApp's Business Messaging Policy allows you to contact people only if they gave you their number and you received opt-in permission confirming they want subsequent messages; it also requires you to honour block and opt-out requests. Messaging a bought list breaks the first condition. The practical result follows quickly: recipients block the unknown business, quality rating falls, templates get paused and messaging limits drop, hurting your follow-up to genuine leads too. Our WhatsApp consent and template rules guide explains how quality ratings and limits work.
Ad platforms close the same door. Google's Customer Match policy allows you to upload only "customer information that you collected in the first-party context", such as people who bought from you or signed up with you; a purchased list is by definition not first-party. Uploading one to Meta custom audiences raises the same rights-and-consent problem.
Why do bought real estate lead lists fail commercially?
Even ignoring the law, the maths rarely works. A worked example with stated assumptions (replace with your own test results):
| Step | Assumption | Result from 10,000 records |
|---|---|---|
| Numbers that connect and belong to the named person | 40% | 4,000 |
| People willing to talk (not hanging up or complaining) | 20% | 800 |
| Actually in the market for property now | 5% | 40 |
| Fit your location and budget | 30% | 12 |
| Complete a site visit | 40% | About 5 |
To get those five visits a calling team makes over 10,000 dial attempts, spends perhaps 300 hours, and annoys several thousand people. For comparison, Indian working ranges published by Sell.do put Meta lead ads at ₹150–2,000 per lead, and every one of those people raised a hand for your project. In our real estate lead generation cost guide, a mid-segment worked example reaches a completed visit for about ₹20,000 of media. The bought list only looks cheaper if staff time, complaint risk and lost numbers are counted as zero.
Other ways bought lists hurt:
- Your sales team learns to dial, not to sell. Hours spent on cold numbers come out of the time for warm leads.
- CRM pollution. Thousands of junk records distort contact, qualification and visit rates by source.
- Brand damage in a small market. In a micro-market, the same families hear about your project from friends; being "the builder who spam-calls" is costly.
What are better alternatives to buying a real estate database?
| Alternative | Typical cost | Why it works |
|---|---|---|
| Meta lead ads with higher-intent forms | ₹150–2,000 per lead (Sell.do range) | Fresh, consented, exclusive; targetable by radius around the project (Meta setup guide) |
| Google Search on project and locality terms | ₹300–2,500 per lead (Sell.do range) | Buyer is actively searching; you control the landing page (Google Ads setup guide) |
| Click-to-WhatsApp ads | Media cost; messages free for 72 hours when you reply within 24 hours | Conversation starts with an opt-in by design |
| Reactivating your own past enquiries | Staff time plus WhatsApp template fees | People who already asked you; see the next section |
| Referrals from past buyers | Referral reward per booking | Highest trust; the buyer contacts you or agrees to be introduced |
| RERA-registered channel partners | Commission on booking | They hold the client relationship and its consent |
| Site events and expos with your own registration | Event cost | Consent is collected for your project directly |
| Free methods: Google Business Profile, portal free listings, local content | Time | Covered in our free real estate leads guide |
If an agency pitches a database as part of its service, treat it as a red flag; our guide to choosing a real estate lead generation company has the contract clause that rules it out.
Can you use your own old enquiries instead?
Usually yes, within limits, and it is the most underused asset in real estate marketing. A buyer who enquired about your project last year has a real relationship with you. To use that data well:
- Use it for the purpose they enquired about (homes from your company), not to sell their details to others.
- Re-confirm interest with one clear message that names your business and lets them opt out; stop on a "no".
- Suppress anyone who opted out, complained or was marked wrong number.
- Prefer WhatsApp templates and calls from registered business numbers; keep records of when and how each person gave their number.
- Set a retention limit, for example deleting dead leads after 24 months without contact, so you are not holding data whose purpose has ended.
Our nurturing and follow-up playbook includes a reactivation cadence for exactly these leads.
What should you do if you already bought a list?
- Stop using it. Pause calls, SMS and WhatsApp to the list, and do not upload it to ad platforms.
- Separate it. Move the records out of your main CRM so they do not mix with consented leads.
- Ask the seller for proof of source, collection date and consent wording for each record. If they cannot provide it, which is the usual outcome, delete the list and keep a note of the deletion.
- Handle complaints properly. Anyone who was already contacted and asked to stop goes on a permanent suppression list.
- Redirect the budget to one of the alternatives above and measure cost per completed visit.
Sources
- Digital Personal Data Protection Act, 2023: Sections 2(i), 6(1), 8(1), 8(7) and Schedule penalties.
- PIB: DPDP Rules, 2025: notification and 18-month phased timeline.
- S.S. Rana & Co.: DPDP Rules phased commencement: obligations from 13 May 2027.
- TRAI Press Release No. 11 of 2025: telemarketing amendment, penalties, thresholds, 90-day consent rule.
- TRAI Press Release No. 91 of 2026: 140xx numbers for promotional calls, DND sector blocking.
- Mobile Seva: SMS DLT registration: entity, header and template registration.
- WhatsApp Business Messaging Policy: opt-in and opt-out requirements.
- Google Ads Customer Match policy: first-party data requirement.
- Deccan Herald and The News Minute: Cyberabad data theft case, 2023.
- Sell.do: paid lead generation for real estate in India, 2026: Meta and Google CPL ranges.