DPDP and your lead database: consent or nothing

The Digital Personal Data Protection Act 2023, with rules notified in November 2025, reaches full enforcement on 13 May 2027, with penalties up to ₹250 crore per contravention. For real estate marketing, one design choice in the law changes everything: unlike GDPR, India recognises no 'legitimate interest' basis. For outbound marketing, consent is the only lawful ground that exists.

What counts as consent

Consent must be free, specific, informed, unambiguous and itemised, and it is channel- and purpose-specific. Consent to receive SMS updates is not consent for WhatsApp marketing. Consent to be contacted about Project A is not consent for Project B. Withdrawal must be as easy as granting, and it must actually propagate, to your CRM, your messaging vendor, and every system that holds the record.

The corollary is brutal for common practice: the purchased lead database, the Excel sheet of '10,000 HNI numbers', has no producible consent chain and no path to one. The entire purchased-data industry is standing on a cliff with a May 2027 date on it.

The dormant database question

What about your own dead leads, people who genuinely enquired two years ago? They gave consent for something, but almost certainly not for what you now want to send, on the channel you want to use. The compliant play is a re-consent flow: a transparent, low-pressure message that re-establishes the basis before any campaign begins. Done well, this is not just legal hygiene, industry benchmarks show 8-9% of dead leads can be revived, contributing 5-6% of total bookings.

Dhanur AI treats consent as an append-only ledger: every grant records the exact text shown, channel, purpose, timestamp and proof; every withdrawal is a new row that triggers a 90-day cooling-off; and every outbound action requires a valid consent token or is refused at the service boundary. When an auditor, or a customer, asks 'on what basis did you message me?', the answer is one query away.