Keeping Client Data Private: A Simple Policy for Small Agencies

A buyer fills in your form, shares her budget and her husband's office location, and two days later gets calls from three brokers she has never heard of. She will not blame the brokers. She will blame you. Client data privacy for small real estate agencies is not a legal nicety; it is the difference between a referral and a one-star review.

The good news is that a three-person agency does not need a compliance department. It needs a one-page policy everyone actually follows. Here is one you can copy, adapt and stick on the wall.

Why client data privacy matters more for small agencies

Big brokerages survive a data leak with a PR statement. You survive on word of mouth in a handful of sectors. One society WhatsApp group saying "that agency sells your number" can cost you a year of work.

There is also the law. India's Digital Personal Data Protection framework expects anyone collecting personal data to use it only for the stated purpose, protect it reasonably and delete it when no longer needed. Penalties are aimed at larger operators, but the principles apply to everyone. Check the current rules and any sector guidance before you publish a formal notice.

Finally, there is sales. Buyers who trust you tell you their real budget. Buyers who do not, lowball and disappear.

The one-page policy

Print this, fill in the blanks and have every team member sign it.

1. What we collect, and why

We collect only what we need to serve the client:

• Name, phone, email
• Requirement (budget, location, type, timeline)
• Documents shared for a specific transaction (ID, PAN, loan papers)
• Source of the enquiry (which ad or board they came from)

We do not collect religion, caste or family details beyond what the client volunteers for a property preference, and we never record those in notes.

2. Who can see it

• Leads and requirements: the owner and the salesperson assigned to that lead. Not the whole team by default.
• Transaction documents: the owner and the person closing that deal only.
• Reports and totals: everyone can see counts and stages; only the owner sees full contact lists.

This is why shared Excel files fail. Everyone has everything, forever, on a pendrive. A system with individual logins lets you give each salesperson their own leads and nothing else. On My Property Pages a Pages plan account gives three sales-team logins where leads can be assigned individually; leads from a page are delivered only to the agent who owns it and are never resold, which is a reasonable baseline to hold any tool to.

3. Where it lives

• Leads live in one system, not in personal phone contacts, not in screenshots, not in a family WhatsApp group.
• Client documents live in a folder per transaction on the owner's drive, not forwarded around on WhatsApp. If a document must be sent, it is sent once, to the bank or lawyer, and deleted from chat afterwards.
• Pages and forms run over HTTPS. If your website URL does not start with https, fix that before anything else.

4. What we never do

• Never share a client's number with another broker, builder or loan agent without asking the client first, every time.
• Never add clients to broadcast lists or groups without their clear yes.
• Never discuss one client's budget or offer with another client, even anonymised. Sectors are small.
• Never photograph ID documents on a personal phone camera roll.

5. When a client asks us to stop

If a buyer says "please remove my number", we do it the same day: out of the CRM, out of broadcast lists, out of the salesperson's phone. We reply once to confirm, then go silent. One polite confirmation message is all they should hear from us again.

6. When a team member leaves

• Logins are revoked on their last working day, before the farewell tea.
• Their open leads are reassigned and the clients get a short message: "Hi, Priya has moved on; I am Gurjeet and I will be handling your search personally from here."
• The offer letter they signed when joining already said client data belongs to the agency and must not be carried to a new job. Remind them, in writing.

You cannot stop someone copying numbers. You can make it clear it is a breach, make it unnecessary by paying fairly, and make sure the clients hear from you first.

Practical habits that make the policy real

A policy on the wall changes nothing. These habits do.

1. One inbox, individual logins. Every enquiry lands in one place, and each salesperson sees only what is assigned to them. Read assigning leads to your sales team without losing track for the mechanics.
2. Notes describe the requirement, not the person. "Wants 3BHK, east-facing, by March, loan pre-approved" is fine. "Sikh family, wife pushy" is not, and it will embarrass you when a client asks what you have on file.
3. Consent sentence on every form. One line under the enquiry button: "We will contact you about this property only. We do not share your details." Then live by it.
4. Document hygiene on Fridays. Ten minutes: clear ID photos from phones, move transaction papers to the right folder, delete chats with documents that are no longer needed.
5. Quarterly clean-out. Leads marked Lost more than a year ago get deleted or anonymised unless the client asked to be kept in touch. See lead nurturing for long buying cycles for the keep-in-touch version done with consent.

A short script for the awkward moments

A builder's sales head asks for your buyer list: "I am happy to bring interested buyers to your site, but I do not share client numbers. Send me the offer and I will pass it on to the ones it fits."

A loan agent wants to be introduced to every lead: "Let me ask each client first. If they want a loan contact, I will connect you."

A client asks what you have on file about them: "Name, number, your requirement and the notes from our calls. Want me to read them out?" If you would be embarrassed to read your notes aloud, rewrite how you take notes.

Publishing a client-facing version

Your internal policy is for the team. Buyers only need three sentences on your profile or property page:

"Your details go only to the agent on this page. We use them only to help with this property or your requirement. Ask us anytime and we will delete them."

Keep it human. Legal-sounding paragraphs nobody reads do not build trust; a short promise you visibly keep does. If you have questions about how lead delivery works on our pages, the FAQ covers it and you can always get in touch.

Frequently asked questions

Is it illegal to share a buyer's number with another broker?

India's data protection law expects personal data to be used for the purpose it was given. Sharing a buyer's number without consent is at minimum a trust breach and increasingly a legal risk; check the current rules and get consent first.

What do I do when a salesperson leaves with client numbers on their phone?

Revoke their logins the same day, reassign their leads, message affected clients with the new contact, and have a signed clause about data return in the offer letter from the start.

Do I need a lawyer to write a privacy policy?

Not for the internal one-page policy in this article. If you run a public-facing website collecting data at scale, have a professional review your published privacy notice.