Insurance and the DPDP Act: An Industry Impact Study

Executive summary

Headline impact rating: High. Insurance runs on personal data, much of it about health, and much of it collected by someone other than the insurer. That combination puts the sector near the top of the exposure range under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025.

Insurers are not starting from zero. IRDAI already requires policy and claim records to be held in India, sets minimum retention periods, restricts sharing without consent and runs a cyber security framework that reaches intermediaries. Since 5 February 2026 the Insurance Act, 1938 itself imposes accuracy, security and confidentiality duties. The DPDP Act operates on top of this rulebook, not instead of it.

The three biggest changes are:

• Consent you can prove, at every hand-off. Leads, proposals and medical reports pass through aggregators, brokers, banks, agents, diagnostic centres and hospitals. Each use needs a lawful ground and, for consent, a Rule 3 notice.
• Accountability for the whole chain. An insurer answers for its data processors whatever the contract says: third party administrators (TPAs), call centres, investigators and technology vendors.
• Breach notices to customers, and SDF duties at the top end. A leak now means a notice to every affected person and a 72-hour report to the Data Protection Board, alongside CERT-In reporting. The largest insurers should plan for Significant Data Fiduciary duties, including checks on underwriting algorithms.

The main obligations commence on 13 May 2027. The slowest work, mapping data across partners and rewriting contracts, should start now.

Background

An insurer's data principals (the individuals the data is about) go well beyond customers: prospects who never bought, proposers, lives assured, nominees, family members on a floater, employees under group cover, claimants and injured third parties in motor claims. One health policy can carry data on five people, supplied by one of them.

The data types are broad:

• identity and KYC data, including Aadhaar or PAN, which the amended Insurance Act lists as part of the policy record;
• income, premium mandates and payout accounts;
• health data from proposals, medical tests and hospital records;
• wellness data from fitness apps and wearables;
• vehicle, property and location data;
• claim files, survey reports, call recordings and complaints.

The data moves through many hands. A retail sale may start on a web aggregator, a bank's app or an agent's phone, pass to underwriting, go out to a diagnostic partner for medicals, and come back. A health claim moves from hospital to TPA to insurer, increasingly through the National Health Claims Exchange (NHCX), a gateway built under the Ayushman Bharat Digital Mission and supported by IRDAI. Motor claims involve garages and surveyors. Reinsurers, some offshore, see data on large risks.

Insurtechs appear as licensed intermediaries, technology vendors and wellness platforms. Under section 2(i), each one's DPDP role turns on whether it determines the purpose and means of processing.

Legal framework

The DPDP Act and Rules. A data fiduciary decides why and how personal data is processed; a data processor acts on its behalf. Processing needs consent under section 6 or one of the closed list of legitimate uses in section 7. There is no "legitimate interests" ground, so fraud analytics, cross-selling and model training must each fit a listed ground or rest on consent. The provisions that matter most for insurers are:

• s.5, s.6 and Rule 3: an itemised, standalone notice with every consent request; consent that is free, specific, informed, unconditional and unambiguous, and as easy to withdraw as to give.
• s.7(a): data a person voluntarily provides for a specified purpose, where she has not objected. This is the natural ground for servicing a policy or a claim the customer started.
• s.8: responsibility for processors "irrespective of any agreement to the contrary"; processors only under a valid contract; accuracy for decisions; reasonable security safeguards; breach intimation; erasure once the purpose is served unless law requires retention.
• s.9 and Rules 10 to 12: verifiable parental consent for children (under 18) and no behavioural monitoring of them. The Fourth Schedule exemptions cover healthcare providers and schools, not insurers or TPAs.
• s.10 and Rule 13: Significant Data Fiduciaries (SDFs) need an India-based Data Protection Officer, an independent data auditor, annual impact assessments and audits, and due diligence on algorithmic software.
• Rules 6 and 7: minimum safeguards including one-year logs; notice to each affected person and a detailed report to the Board within 72 hours.

Penalties are tiered: up to ₹250 crore for security failures, ₹200 crore for breach-notice or children's data failures, and ₹150 crore for SDF failures.

Sector law. The main IRDAI and statutory instruments are:

• Insurance Act, 1938, as amended by the Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025 (Act 40 of 2025), in force from 5 February 2026 except section 25 (S.O. 490(E), 3 February 2026). Policyholder information must be kept accurate, complete, up to date and secure (s.14B). KYC information must be kept confidential and shared only where law compels it, a public duty requires it, or the customer gives express consent (s.14C).
• IRDAI (Protection of Policyholders' Interests, Operations and Allied Matters of Insurers) Regulations, 2024 (F. No. IRDAI/Reg/11/205/2024, 20 March 2024). They bind insurers and distribution channels. Regulation 15 requires information obtained in solicitation and afterwards to be kept confidential and shared only with the policyholder's explicit consent, save for statutory disclosures, risk assessment, claim settlement or an entity the Authority authorises; sharing may not be the default.
• Master Circular on Protection of Policyholders' Interests, 2024 (IRDAI/PP&GR/CIR/MISC/117/9/2024, 5 September 2024): grievances to be resolved within 14 days; death claims settled within 15 days, or 45 days where investigation is warranted; specific consent before an insurer helps create an ABHA number, and express consent for sharing medical records; insurers and TPAs, not the policyholder, collect claim documents from hospitals.
• Master Circular on Health Insurance Business (IRDAI/HLT/CIR/PRO/84/5/2024, 29 May 2024): the same consent rules, and onboarding of hospitals to NHCX.
• IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regulations, 2025 (F. No. IRDAI/Reg/4/211/2025, 1 January 2025). These repealed the IRDAI (Maintenance of Insurance Records) Regulations, 2015. Policy and claim records must be electronic and held in data centres in India. Most records are kept for at least 10 years from the last transaction or policy expiry, under a board-approved retention and destruction policy; settled claim files for 3, 5, 7 or 12 years from settlement, depending on claim value.
• IRDAI Information and Cyber Security Guidelines, 2023 (IRDAI/GA&HR/GDL/MISC/88/04/2023, 24 April 2023). They apply to insurers and IRDAI-regulated intermediaries, require a CISO and an annual independent assurance audit, and require adherence to CERT-In directions.
• IRDAI (Third Party Administrators - Health Services) Regulations, 2016: a TPA may not share policyholder data received for servicing policies or claims, except to courts, government or IRDAI (reg. 19).
• IRDAI (Bima Sugam - Insurance Electronic Marketplace) Regulations, 2024 (F. No. IRDAI/Reg/5/199/2024): a not-for-profit marketplace that must implement a "consent based architecture" for data drawn from providers such as UIDAI, DigiLocker and the CKYC registry.
• CERT-In Directions of 28 April 2022: report cyber incidents within six hours; keep ICT logs for 180 days in India.

How the regimes fit together. Section 38(1) makes the DPDP Act apply in addition to other laws; section 38(2) makes it prevail in a conflict. Most IRDAI rules do not conflict: they add detail or go further, as with India-only storage, which section 16(2) preserves. Where IRDAI requires retention, section 8(7) allows it. Where IRDAI is silent, for example on how a lead is collected or when a declined proposal is deleted, the DPDP Act sets the standard.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Health data and the claims chain

Health data is where insurers carry most risk, and it enters through other organisations.

At underwriting, a diagnostic partner that runs pre-policy tests on the insurer's instruction is usually its processor. Its report should go only to the insurer, under a contract covering Rule 6 safeguards, deletion and incident reporting.

At claim stage, the position is different. The hospital is a data fiduciary in its own right; it holds the patient's records for treatment. When it sends records to a TPA or insurer for a cashless authorisation, it is disclosing data to another fiduciary. IRDAI already requires express consent for sharing medical records, and the Master Circulars place the burden of collecting documents from hospitals on insurers and TPAs. In Trayambic's view the cleanest structure is a short consent, captured at the pre-authorisation or claim form, that names the insurer and TPA and the records to be shared, with the patient's request for cashless treatment as the s.7(a) fallback for the core claim. Broader uses of the same records, such as building risk models, need their own consent.

NHCX changes the plumbing, not the analysis. Hospital and insurer remain fiduciaries for their own processing. Insurers should confirm what consent evidence travels with each claim message, how long NHCX payloads stay in their own systems, and who answers if a message is misrouted.

Genetic data. We found no IRDAI regulation that addresses the use of genetic test results in underwriting. The Delhi High Court held in February 2018 that an exclusion of "genetic disorders" in a health policy was discriminatory; the Supreme Court stayed those findings on 27 August 2018 in United India Insurance v Jay Parkash Tayal and impleaded IRDAI. The DPDP Act has no special category for genetic data, but its consent rules bite hard. A genetic or wellness test offered as a benefit cannot be reused for pricing unless the person consented to that specific use, and a consent that is a condition of cover for unrelated data would not be "unconditional".

The intermediary web: who is responsible for what

Insurance distribution creates genuine fiduciary-processor puzzles. The answer turns on who decides the purpose and the means, which the DPDP Act uses to define a fiduciary.

• Agents and point-of-sale persons act for the insurer. For data they collect in a proposal, they are best treated as the insurer's processors, with the insurer setting the notice, the form and the controls.
• Corporate agents such as banks collect data for their own banking relationship and pass a subset to the insurer. For their own customer data they are fiduciaries; for the proposal they act for the insurer. Both roles need to be written into the agency agreement.
• Brokers act for the client and choose among insurers. They are fiduciaries for their advisory processing and disclose to the chosen insurer, which becomes a fiduciary on receipt.
• Web aggregators and insurtech platforms that generate leads decide how their sites collect data. They are fiduciaries for lead generation. The insurer receiving a lead should insist on evidence of the consent and notice the person saw, because it is the insurer that will contact the person.
• TPAs process claims for the insurer and are classic processors, already bound by IRDAI confidentiality rules. When a TPA services a government health scheme, which the TPA Regulations allow, it answers to that scheme's sponsor, not the insurer.
• Surveyors and investigators are appointed by the insurer for a claim and act as its processors for that file.

This classification is Trayambic's analysis, not settled law. What matters is that each relationship is written down: processor contracts that reflect section 8(2) and Rule 6, and fiduciary-to-fiduciary agreements that say who gives notice, answers rights requests and reports a breach.

Retention: minimum periods are also deletion dates

The 2025 Maintenance of Information Regulations require at least 10 years for most records and value-banded periods for settled claims. Section 8(7) of the DPDP Act permits retention needed to comply with law. Two consequences follow.

First, the IRDAI minimum is not a licence to keep everything indefinitely. Once the regulatory period and any limitation period for claims have run, the record should go, under the board-approved destruction policy the Regulations already require.

Second, much insurer data is not a "policy" or "claim" record at all. Quotes that never converted, abandoned online proposals, purchased lead lists, marketing preferences, wellness app feeds and call recordings for sales calls need their own retention periods justified by purpose. These are where regulators and data principals are most likely to find stale data.

Underwriting models and SDF readiness

No Significant Data Fiduciary has been designated as of October 2026. The section 10 factors, especially volume and sensitivity of data and risk to the rights of data principals, point clearly at large life and health insurers and the largest TPAs. Designation would add an India-based DPO reporting to the board, an independent data auditor, annual impact assessments and audits reported to the Board, and Rule 13 due diligence that algorithmic software does not pose a risk to data principals' rights. Underwriting, claims triage and fraud-scoring models are the obvious candidates for that review. Rule 13 also allows the government to specify data that an SDF may not transfer outside India.

Worked example: a mid-size standalone health insurer

Consider an unnamed standalone health insurer with retail and group business. It sells through two web aggregators, a bank partner and an agency force, uses one TPA for group claims, and runs a wellness app that rewards step counts with premium discounts.

Its DPDP programme:

1. 1.Lead intake. Each aggregator must pass, with every lead, a reference to the notice and consent the person saw. Leads without one are not called.
2. 2.Proposal notice. The Rule 3 notice becomes a separate, itemised page covering proposer, family members and nominee, in the regional languages it sells in.
3. 3.Family members. Each adult member gets a short notice in the welcome kit. For a child member, the proposer parent is the verifying adult under Rule 10, checked against KYC already held.
4. 4.Wellness app. Step data funds only the discount the customer opted into. Using it for renewal pricing would need separate consent, so the insurer decides not to.
5. 5.TPA and hospitals. The TPA contract adds Rule 6 controls, one-year logs, a short incident window and deletion on exit. The pre-authorisation form adds a consent naming insurer and TPA.
6. 6.Retention. Every record class is mapped to the 2025 Regulations; unconverted quotes are deleted after 12 months.
7. 7.Breach drill. A simulated TPA leak must produce the CERT-In report, customer notices and the 72-hour Board report from real systems.

Compliance framework

Phased roadmap to 13 May 2027

• Now to December 2026: data map, partner classification, gap assessment and board briefing. Consent managers can register from 13 November 2026; decide whether to use them.
• January to March 2027: notices, consent journeys, contract amendments, breach playbook and children's data controls.
• April to May 2027: retention clean-up, rights workflow, staff and agent training, SDF artefacts, final readiness review.
• Ongoing: annual vendor audits, model reviews, deletion runs and watch for SDF notifications, Board guidance and any further IRDAI circulars.

Recommendations

1. 1.Treat every lead and proposal as needing an auditable consent record, and refuse partner data that arrives without one.
2. 2.Write down, for each intermediary and vendor, whether it is a fiduciary or processor, and contract accordingly.
3. 3.Put consent for sharing medical records into the claim and pre-authorisation forms, naming the insurer and TPA.
4. 4.Keep wellness, genetic and other optional data out of underwriting unless the person gave a separate, specific consent.
5. 5.Use the IRDAI retention periods as a schedule for deletion as well as retention, and set short limits for non-policy data.
6. 6.Run one integrated breach playbook covering CERT-In, IRDAI, the Board and customers.
7. 7.If you are a large life or health insurer or TPA, prepare now for SDF duties, starting with an inventory of underwriting and claims models.

Key takeaways

• Insurance is rated High impact: health data at scale, collected through long partner chains.
• IRDAI already requires India-only record storage, confidentiality and minimum retention; the DPDP Act adds consent proof, customer breach notices and processor accountability.
• The 2015 Maintenance of Insurance Records Regulations were repealed by the 2025 Maintenance of Information Regulations, which set a 10-year floor and value-banded claim retention.
• Each intermediary and vendor should be classified as fiduciary or processor, and contracts rewritten to match.
• Large life and health insurers and TPAs should prepare for Significant Data Fiduciary duties, including algorithmic due diligence of underwriting models.