On this page
Treat every lead's details as data you hold for one stated purpose. Say why you collect them, use them only for that, share them only with consent, keep them secure and delete them when you no longer need them. Answer access requests, and report notifiable breaches to the PDPC within 3 calendar days of assessing them.12
Does the PDPA apply to you, or only to your agency?
It can apply to you directly. The PDPC's guidelines for the real estate agency sector, written with CEA, say salespersons who are not employees of their agency "may instead be considered separate organisations" and must comply with the PDPA as if they were.3 CEA says the real estate agency industry must comply with the PDPA.9
The PDPC has applied this to agents in its decisions. In 2016 it fined a landlord's salesperson S$500 for giving two tenants' names and NRIC numbers to another tenant after a dispute. It found he was "an 'organisation' under the PDPA, separate from the company which had engaged him".11 In a 2023 decision it noted that, in line with industry practice, "real estate salespersons ... are not in an 'employer-employee relationship' with their agencies".13
Whether you are an organisation or your agency's data intermediary depends on your working arrangement with the agency.3 Either way, you have duties.
An organisation that processes personal data on behalf of another organisation, such as a salesperson delivering a client's signed estate agency agreement to the agency under their written agreement. A data intermediary working under a written contract must still protect the data, stop keeping it when it is no longer needed, and tell the other organisation about a breach without undue delay.31
The stakes are real. For breaches of the data protection rules, the PDPC can impose a financial penalty of up to S$1 million, or 10% of annual turnover in Singapore for organisations with turnover above S$10 million.1 CEA's Code of Ethics separately bars you from disclosing or using a client's confidential information without consent unless the law requires or allows it.10
What must you tell a lead when you collect their details?
Tell them what you will use their details for, on or before you collect them, and have their consent for that purpose.1 On a landing page, that means a short line by the Submit button and a linked notice. Our new launch landing page checklist covers the form itself.
- Be specific. In a PDPC example, a form that lists "any other purpose that it deems fit" is not a reasonable purpose.2 Name the purposes: replying to the enquiry, arranging a viewing, sending the project details asked for.
- Collect only what you need. Holding more data than you need increases the work of protecting it, the PDPC notes.2 A name, number and email answer most enquiries.
- Give a contact. If a lead asks, you must give the business contact of someone who can answer questions about how you use their data.1
When someone gives you their details for a purpose, such as asking for a brochure, they are deemed to consent to you using them for that purpose.3 That covers the reply. It does not cover everything you might want to do next.
Can you use a lead's details for other projects or marketing?
Only for purposes a reasonable person would think appropriate and that you told the lead about.1 If you want to use the details for a new purpose, you must tell the lead before you use them that way.1
Marketing by phone adds the Do Not Call rules. A reply whose sole purpose is to answer the lead's request is not a marketing ("specified") message.8 Messages promoting property usually are, so sending other launches is.3 Before you send one to a Singapore number, check the DNC Registry within the previous 21 days, unless you hold clear consent you can prove. This covers WhatsApp too.8 Our guide to following up enquiries within PDPA and DNC rules explains how to word consent and what counts as marketing.
Never buy lead lists without checking where they came from. In 2023 the PDPC found that a salesperson who paid about S$1,200 for some 420,000 records had collected personal data without consent. It made that finding even though he checked numbers against the DNC Registry before texting.12
"ignorance is not a legitimate excuse for breaching the Consent Obligation." (PDPC, [2023] SGPDPC 14)12
He was fined S$16,800, reduced from S$28,000 because of his financial hardship (the PDPC said this sets no precedent), and directed to stop using the data at once and delete it within 7 days.12
Can you share a lead with a co-broke or your team?
Get the person's consent first. The PDPC's own co-broking example says a salesperson who wants to pass a buyer's name, NRIC and contact details to the seller's agent "would be required to obtain consent from the buyer".3 Once the buyer consents to that disclosure for a purpose, the receiving agent is deemed to have consent to use the details for the same purpose.3
Teams work the same way in our reading. If your teammates are independent salespersons, each is likely a separate organisation, so handing them your lead is a disclosure.3 Say on your form that the enquiry may be passed to your team at your agency to reply. Ask your agency how it treats team leads.
- Service providers. A CRM, call centre or lead-handling vendor that processes leads for you is a data intermediary. You keep the same obligations as if you processed the data yourself.2
- Overseas systems. If your CRM or cloud storage keeps data outside Singapore, the PDPA's transfer rules apply. The PDPC's example is a US-based CRM: you must ensure the provider protects the data adequately.2
- Team members who leak leads. An individual who knowingly or recklessly discloses personal data held by an organisation without its authority commits an offence, with a fine of up to S$5,000, up to 2 years' jail, or both.1
Where should you store leads: phone, spreadsheet, WhatsApp or CRM?
Wherever they sit, you must make "reasonable security arrangements" against unauthorised access, disclosure, copying or loss, including loss of the phone or drive they are on.1 The PDPA does not prescribe tools. The table turns the PDPC's examples of security measures into steps for the places agents usually keep leads; it is our suggestion, not a rule.
| Where leads sit | Main risk | Steps to take |
|---|---|---|
| Phone contacts and WhatsApp chats | Lost or unlocked phone; forwarding to the wrong chat | Screen lock and stronger sign-in; check the recipient before you forward details2 |
| Spreadsheets | Copies emailed around; links anyone can open | Share with named people only; delete columns you do not need2 |
| CRM or lead app | Former team members keep access | Give access on a need-to-know basis and remove leavers promptly2 |
| Paper forms from showflats | Left on tables, thrown away whole | Lock them away, then shred them2 |
Do not protect files or accounts with NRIC-based passwords such as "567A01Jan80". The PDPC says such passwords should not be used to access digital documents. Private organisations have until 31 Dec 2026 to stop using NRIC numbers for authentication, with stepped-up enforcement from 1 Jan 2027.7
How long can you keep leads, and how do you delete them?
Keep a lead only while it serves the purpose you collected it for, or a legal or business purpose.1 The PDPA sets no fixed period. You must not keep data "just in case". The PDPC says you should review what you hold regularly and, as good practice, set a retention policy.2
- Transaction records are different. Your agency must keep documents such as estate agency agreements and options to purchase for at least 5 years under CEA's Code of Practice.10 Unconverted enquiries have no such rule.
- Archiving is not deleting. Data you archive or restrict is still retained. You have stopped keeping it only when you, your agents and your data intermediaries no longer have access. The PDPC gives deleted files left in an un-emptied recycle bin as an example of data that may still be within reach.2
- Stop when asked. A lead can withdraw consent at any time. As a rule of thumb, the PDPC considers 10 business days from receiving the notice reasonable, and you must make your data intermediaries stop too.2
A simple habit, our suggestion rather than a rule: review leads on a fixed date each quarter and delete the ones that have gone quiet and never agreed to updates.
What do you do when a lead asks to see or correct their data?
Answer as soon as reasonably possible. If you cannot respond to an access request within 30 days, tell the person in writing within those 30 days when you will.2
- Access. Give them the personal data you hold or control, and how it was used or disclosed in the past year. You may charge a reasonable fee.2
- Correction. Correct errors as soon as practicable, at no charge, and send the corrected data to every organisation you disclosed it to in the past year that still needs it.2
- Where requests go. The PDPC expects organisations to accept written requests sent to their data protection officer's business contact.2 Find out who your agency's officer is before a lead asks.
What counts as a data breach, and when must you report it?
A data breach is unauthorised access, use, disclosure, copying, modification or disposal of personal data. It includes losing a device that holds the data where unauthorised access is likely.1 The PDPC's examples include an email attachment sent to the wrong recipient.2
Follow the PDPC's four steps, known as C.A.R.E.:4
- Contain. Recall the message, ask the recipient to delete it, reset passwords, or remotely disable a lost device.42
- Assess. Do it quickly and write down every step; the PDPC expects this generally within 30 calendar days.2 Tell your agency at once. If you are its data intermediary, you must notify it without undue delay.1
- Report. If the breach is notifiable, notify the PDPC within 3 calendar days after the day you assess it as notifiable. An assessment made on 1 January means notifying by 4 January.12 Where significant harm is likely, notify the affected people at the same time or after.1
- Evaluate. Fix what caused it.4
A breach that is likely to cause significant harm to someone, or that affects 500 or more people. Harm is deemed significant when a person's full name or full NRIC number is exposed together with prescribed data, such as bank account or card numbers or their income from selling property, or when an account name is exposed with its password.125
| What leaked | Tell the PDPC? | Tell the people affected? |
|---|---|---|
| Names and contact details of fewer than 500 people | No2 | No2 |
| Names and contact details of 500 or more people | Yes25 | No, if no prescribed data2 |
| Full names or NRIC numbers with prescribed data, such as bank account numbers | Yes5 | Yes, unless an exception applies1 |
| As above, but strongly encrypted before the breach | Yes2 | Generally no2 |
Agencies are targets too. In 2023 the PDPC fined a real estate agency S$37,000 for failing to protect data that attackers took from its unencrypted servers: records of 256,583 people, including customers' names, NRIC numbers and transaction amounts.14
What are the NRIC rules for property agents?
Organisations generally may not collect, use or disclose NRIC numbers or copies of NRIC. The exceptions are where the law requires it, or where it is needed to verify identity to a high degree of fidelity.6 The PDPC lists property transactions as one such situation.6
- Enquiry and interest forms. The PDPC's example of customers registering interest in a new product says not to collect NRIC numbers. Collect names and contact details instead.6 In our reading, a showflat booking or a launch registration is closer to registering interest than to a transaction.
- Partial numbers. The last 3 digits and checksum, such as "567A", do not count as the full NRIC number. They are still personal data you must protect.6
- Same treatment. Birth certificate numbers, FINs and work permit numbers are treated like NRIC numbers.6
- When you do collect it. Be ready to justify why, and protect NRIC numbers more strongly than other data.6
The PDPA lead-handling checklist
| Stage | Check | Source |
|---|---|---|
| Collect | Form states specific purposes before Submit | PDPA s201; PDPC2 |
| Collect | Separate, optional box for phone, SMS or WhatsApp offers | PDPC DNC guidelines8 |
| Collect | No full NRIC numbers on enquiry or interest forms | PDPC NRIC guidelines6 |
| Collect | No bought lists without proof of consent and notice | [2023] SGPDPC 1412 |
| Use | Only for the purposes you stated; tell leads before any new one | PDPA s18, s201 |
| Use | DNC check within 21 days before marketing, unless you have clear consent | PDPC DNC guidelines8 |
| Share | Consent before passing a lead to a co-broke or teammate | PDPC real estate guidelines3 |
| Share | Written terms with CRM and service providers; you stay responsible | PDPC2 |
| Store | Locked devices, need-to-know access, leavers removed | PDPA s241; PDPC2 |
| Store | No NRIC-based passwords on files or accounts | PDPC, 2 Feb 20267 |
| Keep | Regular review; delete everywhere, including vendors and backups | PDPA s251; PDPC2 |
| Requests | Access within 30 days or say when; corrections free | PDPC2 |
| Breach | Contain, tell your agency, assess, PDPC within 3 calendar days if notifiable | PDPA s26C, s26D1; PDPC4 |
This checklist summarises the PDPA, PDPC guidelines and decisions, and CEA rules as read on 12 Nov 2026. This is general information, not legal advice. Your agency's data protection officer or a lawyer can tell you how the rules apply to your arrangement with your agency.
Frequently asked questions
Is a lost phone with leads on it a data breach?
It can be. The PDPA counts the loss of a device holding personal data as a breach where unauthorised access is likely.1 A screen lock and encryption make that less likely. Assess it quickly and tell your agency. If the phone held 500 or more people's details, or prescribed data such as bank account numbers with full names, notify the PDPC within 3 calendar days of assessing that it is notifiable.125
Can I buy a list of property leads?
Buying a list counts as collecting the data, so you need the people's consent and must have told them the purpose. The PDPC expects buyers to do due diligence, such as getting written confirmation the data was obtained lawfully and a sample of the consent and notice. A salesperson who skipped this was fined S$16,800 in 2023.12
How long can I keep old leads?
Can I ask a buyer for their NRIC number at the showflat?
In our reading, not for registering interest or booking a viewing. The PDPC's guidance for registering interest is to collect a name and contact details instead.6 NRIC numbers may be collected where the law requires it or to verify identity to a high degree, which the PDPC says includes property transactions.6
Do I need my own data protection officer?
Your agency must designate one.2 If the PDPC treats you as a separate organisation, the PDPA's duties fall on you too, including giving leads a contact for questions about their data.13 In our reading, that includes the duty to designate someone responsible for compliance, which in a one-person business is likely you. Ask your agency's officer how this applies to your agreement.
Sources
- Attorney-General's Chambers, Personal Data Protection Act 2012, Singapore Statutes Online, version in force from 16 Oct 2026, accessed 12 Nov 2026.
- Personal Data Protection Commission, Advisory Guidelines on Key Concepts in the PDPA, revised 29 Apr 2026, accessed 12 Nov 2026.
- Personal Data Protection Commission, Advisory Guidelines for the Real Estate Agency Sector, 16 May 2014, accessed 12 Nov 2026.
- Personal Data Protection Commission, Guide on Managing and Notifying Data Breaches under the PDPA, revised 15 Mar 2021, accessed 12 Nov 2026.
- Attorney-General's Chambers, Personal Data Protection (Notification of Data Breaches) Regulations 2021, 29 Jan 2021, accessed 12 Nov 2026.
- Personal Data Protection Commission, Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers, 31 Aug 2018, accessed 12 Nov 2026.
- Personal Data Protection Commission, Organisations to cease the use of NRIC numbers for authentication by 31 December 2026, 2 Feb 2026, accessed 12 Nov 2026.
- Personal Data Protection Commission, Advisory Guidelines on the Do Not Call Provisions, revised 1 Feb 2021, accessed 12 Nov 2026.
- Council for Estate Agencies, Personal data protection, last updated 11 Aug 2025, accessed 12 Nov 2026.
- Attorney-General's Chambers, Estate Agents (Estate Agency Work) Regulations 2010, First and Second Schedules, version in force from 1 Jan 2026, accessed 12 Nov 2026.
- Personal Data Protection Commission, Breach of Consent Obligation by a Registered Salesperson, decision [2016] SGPDPC 13, 12 Aug 2016, accessed 12 Nov 2026.
- Personal Data Protection Commission, Breach of the Consent and Notification Obligations by a Registered Salesperson (copy on Singapore Law Watch), decision [2023] SGPDPC 14, 29 Dec 2023, published 21 Mar 2024, accessed 12 Nov 2026.
- Personal Data Protection Commission, Decision on a real estate salesperson's marketing SMSes, decision [2023] SGPDPC 8, 11 Jul 2023, accessed 12 Nov 2026.
- Personal Data Protection Commission, Breach of the Protection Obligation by OrangeTee & Tie, decision [2023] SGPDPC 3, 21 Feb 2023, accessed 12 Nov 2026.
The ProjectSG team writes about Google Ads, lead generation and new launch marketing for Singapore property agents, drawing on campaigns we run every day.
Researched and drafted with AI assistance, then fact-checked and approved by a named ProjectSG reviewer before publishing. Last updated 12 Nov 2026. Read our editorial policy. Spotted an error? Email info@project.sg.
