One client. One property decision. Many systems and people.
Follow buyer, tenant, seller and landlord data through lead capture, qualification, site visits, broker networks, KYC, loan processing, agreements, registration, possession, property management and long-term archives - and count every place it ends up, and where you lose control of it.
- 1
Lead capture & first enquiry control breaks
+6 places · 6 so farA buyer or tenant enquires through a portal listing, a project ad, the website, a walk-in or a forwarded number. Within minutes the same person exists on a portal dashboard, in a shared spreadsheet, in an ad platform's audience and on a salesperson's own phone.
Where control breaks: The lead is on a spreadsheet before anyone has been told anything
Moving hereClient identity & contact (new at this stage)Requirement & budget (new at this stage)Calls, messages & sales notes (new at this stage)Marketing & audience profile· inferred (new at this stage)DPDPAThis is the moment to say what you collect and why. An enquiry made about one property is not consent to be contacted about every property for the next five years.
- 2
Qualification, budget & household profiling control breaks
+2 places · 8 so farThe follow-up call establishes budget, income, employer, family size, timeline and how serious they are - and records all of it, along with the salesperson's own opinion, in a CRM everyone in the office can open.
Where control breaks: Everyone in the office can read what you guessed about a client
Moving hereKYC & identity proofs (new at this stage)Household & occupancy details (new at this stage)Employment & income (new at this stage)Other people's records in the file (new at this stage)Scores & labels about the client· inferred (new at this stage)Client identity & contact+2 moreDPDPAGuessed income and personal remarks are still personal data, and a data principal can ask to see and correct them. Keep notes factual and separate what was told to you from what was assumed.
- 3
Property matching & broker-network sharing control breaks
+3 places · 11 so farTo find stock, the requirement goes out: to co-broker WhatsApp groups, shared inventory sheets, channel-partner portals, builder teams and owners. The client's number, budget and household details now sit on phones the firm has never seen.
Where control breaks: One post puts your client on forty phones
Moving hereProperty & ownership papers (new at this stage)Client identity & contactHousehold & occupancy detailsRequirement & budgetScores & labels about the client· inferredDPDPAEvery onward share is a disclosure. Share the requirement before the identity where you can, keep a record of who received what, and be able to tell a client who now holds their number.
- 4
Site visits, walk-ins & field coordination control breaks
+5 places · 16 so farThe visit is arranged and the client's name, number and arrival time go to a field executive, a security desk, a site office or an owner. Gate registers, CCTV, visit photos, routes and shared live locations all record it.
Where control breaks: The site visit hands out the client's number and their movements
Moving hereSite-visit & location records (new at this stage)Client identity & contactHousehold & occupancy detailsRequirement & budgetCalls, messages & sales notesScores & labels about the client· inferredDPDPAA site visit generates location and attendance data about the client and whoever came with them. Share the minimum the visit needs and set a retention period for registers, footage and photos.
- 5
Offer, booking & terms
+2 places · 18 so farAn offer, a booking form or rent terms are put together, and with them the client's payment capacity, co-applicant, nominee and move-in plan. Screenshots of the offer travel between the firm, the owner and the network.
Moving hereBank, loan & payment records (new at this stage)Agreements & transaction records (new at this stage)Client identity & contactEmployment & incomeRequirement & budgetOther people's records in the file+1 moreDPDPAA co-applicant, guarantor or nominee is a separate data principal. Record who authorised whom to speak, and do not disclose one applicant's financial position to another party by default.
- 6
KYC, identity & property documents control breaks
+6 places · 24 so farPAN, Aadhaar, passport, address proof, salary slips, bank statements and the property's title papers arrive - by WhatsApp, by email, as photos, as a bundle of hard copies - and are filed in whichever folder the coordinator uses.
Where control breaks: PAN, Aadhaar and bank statements arrive on WhatsApp and never leave
Moving hereStaff, device & access records (new at this stage)KYC & identity proofsEmployment & incomeBank, loan & payment recordsProperty & ownership papersOther people's records in the fileDPDPAThese are the highest-impact documents you hold. Collect them only when the transaction actually needs them, use one controlled channel, and know which copies exist where.
- 7
Loan, lender & payment coordination
+3 places · 27 so farTo arrange finance the full file - identity, income proof, bank statements, employment details and the property papers - goes to a loan agent, then onward to two or three banks and NBFCs to see who says yes.
Moving hereClient identity & contactKYC & identity proofsEmployment & incomeBank, loan & payment recordsProperty & ownership papersAgreements & transaction records+3 moreDPDPAEvery lender approached is a separate recipient of high-impact financial data. Send on the client's instruction, record who received the file, and close out the copies held by lenders who declined.
- 8
Agreement, stamp duty & registration control breaks
+4 places · 31 so farDrafters, lawyers, notaries and registration agents assemble the instrument. Identity documents go to each of them, drafts circulate by email and WhatsApp, witnesses are named, and the executed document is registered with the sub-registrar.
Where control breaks: Every intermediary gets the whole file because it is quicker
Moving hereClient identity & contactKYC & identity proofsProperty & ownership papersAgreements & transaction recordsOther people's records in the fileDPDPAA registered instrument is an authority-controlled record: it is not yours to correct or delete afterwards. Share the minimum set with each intermediary and clear the working drafts once the final version exists.
- 9
Commission, referral & post-deal reuse control breaks
+4 places · 35 so farThe deal is invoiced, commission is split and paid - and the client becomes a referral source, a review request, a lookalike audience and a future-investment prospect. So does the client whose deal fell through.
Where control breaks: Closing the deal moves them into the marketing list, not out of it
Moving hereClient identity & contactBank, loan & payment recordsRequirement & budgetAgreements & transaction recordsScores & labels about the client· inferredMarketing & audience profile· inferredDPDPAFinishing the service is not permission to market. Keep transaction communication separate from promotion, and make a withdrawal request stick across every channel, list and agency export.
- 10
Old leads, closed deals, archives & deletion control breaks
+2 places · 37 so farEverything settles into the archive - CRM history, KYC folders, agreement copies, WhatsApp threads, staff phones, backups, the file cupboard, and the old-lead database that is quietly the firm's most valuable asset.
Where control breaks: Nothing is ever deleted, because the old database is the business
Moving hereClient identity & contactKYC & identity proofsHousehold & occupancy detailsBank, loan & payment recordsRequirement & budgetProperty & ownership papers+6 moreDPDPARetention has to be decided per category, not for the file as a whole. Tax and commission records and the registered instrument have grounds to be kept; a five-year-old enquiry that never became a deal does not.
Top risk hotspots - where control usually breaks
The 8 places client data most often slips out of your control. Each links to the matching check in the readiness assessment.
- Hotspot 1 Critical risk
To find matching stock, the requirement goes into the co-broker or channel-partner group: name, mobile number, budget, area, and often how many people will live there. Every agent in the group now has it on their own handset.
Why this matters
It cannot be recalled, the recipients cannot be listed, and none of them is under any instruction about what to keep. When the client later asks who has their number, this is the part of the answer no firm can give.
Fix: Post the requirement without the identity first, and release the number only to the agent who actually has matching stock - with a note of who was given what, and never a KYC document in a group.
Check this in the assessment - Hotspot 2 Critical risk
Identity proofs, salary slips, six months of bank statements and the property's title chain come in as photographs and email attachments, get saved into a folder, downloaded to a laptop, printed for the file and backed up to a cloud drive.
Why this matters
This is the highest-impact collection the firm holds, and it exists in five places at once because it was never collected through one. Nobody can say how many copies of a client's Aadhaar the office currently has.
Fix: Move collection to a secure upload link, keep one folder per transaction with named access, mask the identifiers the deal does not need, and clear the working copies once it closes.
Check this in the assessment - Hotspot 3 Critical risk
Enquiries that went nowhere, buyers from four years ago, tenants who moved out, numbers inherited from a departed salesperson - all kept, all still worked, all still called when a new project launches.
Why this matters
Most of the people in it never transacted and were never told they would be kept this long. In every other sector data is retained by inertia; here it is retained deliberately, because an old lead is worth money - which is exactly why a retention rule feels like losing an asset.
Fix: Set a retention period per category - enquiry, KYC, transaction, tax - and age out unconverted leads on that clock. Separate what you must keep from what you have merely never deleted.
Check this in the assessment - Hotspot 4 Critical risk
The CRM record holds an income band nobody verified, family and occupancy details, a seriousness score and the salesperson's own remarks - open to the whole team, exportable by anyone, and still there years later.
Why this matters
A client can ask to see and correct what you hold about them, including the opinions. Broad access also means a departing executive leaves with the client base, which in this industry is treated as normal.
Fix: Move to deal-based access, keep notes factual and separate assumptions from what the client actually told you, restrict exports to the owner, and remove access on the last working day.
Check this in the assessment - Hotspot 5 Critical risk
Portal exports, ad-form leads and walk-ins all land in a shared sheet within minutes - shared by link with the team, the agency and sometimes a co-broker, and never revoked once shared.
Why this matters
It is the firm's real intake system and it sits entirely outside any notice, any access control and any retention rule. It is also the first thing anyone downloads on their way out of the door.
Fix: Make the CRM the only intake record, switch the sheet to view-only with named access, and audit who currently holds the link before changing anything else.
Check this in the assessment - Hotspot 6 Critical risk
The field executive gets the client's details on a personal handset, the client's number is shared with the site office, the owner and a co-broker, the gate register takes it down in front of the next visitor, and a live location keeps updating after everyone has gone home.
Why this matters
A visit generates location, attendance and household data about the client and whoever came with them, spread across parties the firm does not control - and it all stays on a phone that leaves when the executive does.
Fix: Route visits through the scheduler rather than direct numbers, turn off contact sync on work accounts, agree a retention period for gate registers and footage, and wipe the work profile when someone leaves.
Check this in the assessment - Hotspot 7 Critical risk
The drafter, the advocate, the stamp vendor, the notary and the registration agent are each sent the complete identity and property set - along with the co-applicant's and the witnesses' documents - and each keeps a copy.
Why this matters
Nobody can say afterwards which of them still holds what. And once the instrument is registered, that part becomes an authority-controlled public record that the firm cannot correct or withdraw at all.
Fix: Work out which documents each intermediary actually needs and send only those; get a written deletion commitment from the agents you use repeatedly; and tell the client at signing which parts become a public record.
Check this in the assessment - Hotspot 8 Critical risk
Completed clients, failed deals and old enquiries are pushed into campaign lists, referral chases, WhatsApp broadcasts from personal numbers, and audiences uploaded back to the ad platform for the next launch.
Why this matters
A withdrawal honoured in the CRM does not reach the agency's export, the broadcast list or an audience already uploaded - so the person keeps hearing from you after asking you to stop, which is the complaint that actually gets made.
Fix: Keep one suppression list that every channel and agency must check before sending, remove uploaded audiences when someone withdraws, and stop adding closed clients to campaigns automatically.
Check this in the assessment
What happens when someone asks
The map above shows where client data ends up. This is what that means the day someone asks you to find it, fix it or remove it - including the places a request realistically cannot reach.
Who asks: Someone who made one enquiry and is now being called by people they have never heard of
Where you have to look
- Sales CRMYour firm
- Shared lead spreadsheetYour firm
- Property portal dashboardPortals, CRM & service vendors
- Meta / Google lead-ad platformPortals, CRM & service vendors
- Staff WhatsApp & personal chatYour firm
- Marketing lists & audience uploadsYour firm
- Old lead & past-client databaseYour firm
Where this usually cannot reach
- Co-broker & channel WhatsApp groupBrokers, lenders & others who receive it
- Co-broker / freelance agentBrokers, lenders & others who receive it
- Marketing agency's dashboardPortals, CRM & service vendors
- Former staff's phone & exportsBrokers, lenders & others who receive it
What has to happen
- Confirm who is asking, using the number or email the enquiry came in on.
- Find every record of them: the CRM, the lead sheet, the portal dashboard and the historic database - the same person is usually in all four.
- Establish which enquiry started it, when, and through which channel.
- List where their requirement was shared onward - the broker group, a partner, the marketing agency - and say so plainly.
- Give them what you hold, including the notes and scores, not just the contact fields.
- Suppress them everywhere at the same time if they ask you to stop.
The part that usually fails: The honest answer has two halves. You can account for what is inside your systems. You cannot account for the broker group - once a requirement was posted there, the recipients cannot be listed and nothing obliges any of them to delete it.
Check whether you could answer this todayWhen it has already gone wrong
An operational response reference for the incidents this sector actually has - what to do in the first hour, what to put right afterwards, and the control that stops a repeat. Whether an incident needs to be reported is a decision to take with your own advisers.
How you find out: A stranger replies "I think you've sent me someone's documents" - or the client rings, having been told by them
Systems involved
- Staff WhatsApp & personal chatYour firm
- KYC & document folderYour firm
- Field executive's own phoneYour firm
- Sales CRMYour firm
First - stop it spreading
- Delete for everyone immediately - it only works inside the window, so this is the first action, not the third.
- Ask the recipient to delete the media from their phone and their gallery, and confirm.
- Check whether it was forwarded on before you got to it.
- Stop any further documents going out on that thread.
Then - correct it and record it
- Write down exactly which documents went to which number and when.
- Tell the client plainly, including what you were able to confirm and what you were not.
- Advise them of the practical step available to them - masking or re-issuing the identifier where that is possible.
- Log it as an incident with the cause, not just the fix.
The control that prevents a repeat: Take identity documents through a secure upload link rather than chat, and turn off media auto-download so a mis-sent file is not already in someone's gallery.
How to read this journey
Pick your model
Switch between Brokerage & property consultancy, Developer / builder sales and Rental & property management to see the journey each kind of property business actually runs. This is not a filter over one journey - a brokerage matches a client to someone else's property and never runs a construction payment schedule; a developer carries the buyer for years through demand notices, possession and handover to the RWA; a property manager takes a mandate over somebody's home and then holds an ongoing relationship with keys, vendors and a society. The stage count and the place-counter recalculate for the model you choose.
When it leaves you
A violet left edge and a tag mark everything outside your firm - portals and CRM vendors, co-brokers and channel partners, builders, landlords and societies, loan agents and lenders, drafting and registration agents, the sub-registrar, and anything that becomes an open link or a public record. Once data is there your control is indirect at best: it runs through your instructions and your contract, not your systems. Risk is shown separately, as an amber or red fill - so an outside system can be low risk, and your own field executive's phone can be one of the worst things on the page.
Where control breaks
Red flags mark the hotspots - the eight places property firms most often lose control of client data, from a requirement posted to forty agents at once, to PAN and bank statements arriving on WhatsApp, to an old-lead database that is never deleted because it is the firm's real asset. Tap any system to see what it holds and how to fix it.
Now check whether your controls hold up
The map shows where client and property data travels in a typical property business. The 3-minute readiness scan checks whether your firm has the controls that matter at each hotspot - and the Discovery tool builds your own data inventory.
Educational reference model - not legal advice, and not a scan of your actual systems.