DPDP Act for Insurers, Brokers & Insurtech: Compliance Guide
Insurers, third-party administrators, brokers, agents and insurtech platforms collect health histories, financial details, family information and claims evidence. The DPDP Act and Rules add a consent-and-rights framework on top of IRDAI's requirements.
The Act has no separate "sensitive data" category, so health and financial data follow the same rules as any other personal data, but the risk is far higher, so safeguards should match. Main duties: clear notice, valid consent beyond what a customer voluntarily provides for a stated purpose, security, breach reporting and rights handling. Because insurance runs through chains of intermediaries, mapping who is a fiduciary and who is a processor is the first job. Most duties take effect on 13 May 2027.
Who this covers
Life, health and general insurers are Data Fiduciaries for proposers, policyholders, nominees and claimants.
Third-party administrators (TPAs) can be processors for an insurer, or fiduciaries for their own purposes.
Brokers, corporate agents and POSPs collect data from customers and are often fiduciaries in their own right.
Insurtech and aggregator platforms collect leads and share them with several insurers.
Surveyors, investigators, hospitals and medical examiners handle data for the insurer or on their own account.
Personal data you are likely to hold
Key provisions for Insurance
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
A clear notice and consent for anything beyond what the customer voluntarily provides for a stated purpose.
Data a person voluntarily gives for a stated purpose, and disclosures to the State that a law requires, are legitimate uses.
Accuracy where data drives decisions, security, breach intimation, erasure and processor contracts.
Policies for children need a parent's verifiable consent.
Customers can nominate someone to exercise their rights if they die or are incapacitated.
Erasure gives way where law requires retention.
The Act works alongside insurance laws and IRDAI regulations.
01Proposals, underwriting and consent
A proposer who fills in a form gives data voluntarily for a stated purpose, a legitimate use under Section 7. Keep to that purpose. Other uses need consent: marketing, cross-selling, sharing with group companies for their own purposes, and analytics unrelated to the policy.
- Put the purposes in a short itemised notice (Rule 3) shown before the proposal is submitted.
- Keep marketing consent separate and optional. A refusal must not block the policy.
- Where underwriting uses automated scoring, make sure data is accurate and complete, because Section 8 requires accuracy where data is used to make decisions about the person.
02Claims, health data and third parties
Claims involve the most sensitive data: medical records, hospital bills, accident reports and sometimes police documents. Use it only to assess and settle the claim, share it only with those who need it (hospitals, TPAs, surveyors, reinsurers), and restrict internal access.
- Sign written contracts with TPAs, surveyors, investigators and hospital billing agencies where they process data for you.
- Do not use claims data for marketing or to profile the customer for unrelated products.
- Disclosures to the State required by law, such as to tax, police or insurance regulators, are covered by the legal-obligation legitimate use.
03Agents, brokers and aggregators
Distribution chains mean one customer record can pass through an aggregator, a broker, an insurer and a TPA. For each flow, decide who decides the purpose. An aggregator selling leads to several insurers needs consent naming that sharing. An agent using a customer's details for their own sales is a fiduciary and needs a lawful basis.
Write clear data-sharing terms into agent, broker and aggregator agreements, train distribution staff, and avoid keeping personal lists on personal phones and spreadsheets.
04Retention, nominees and rights
Insurance records are often kept for long periods because policies run for decades and claims can arise late. Section 12 lets you keep what law and the policy contract require, so set retention periods by record type and tell customers what you keep and why. Erase data from unsuccessful proposals and marketing leads once their purpose ends.
Section 14 lets a customer nominate another person to exercise their rights if they die or lose capacity. Build this into servicing alongside the policy nominee, and keep them distinct.
05Security and breach reporting
Rule 6 sets baseline safeguards. IRDAI information-security requirements and CERT-In reporting apply alongside. A breach means telling each affected customer and the Board, with a detailed report within 72 hours (Rule 7). Large insurers may also be notified as Significant Data Fiduciaries under Section 10.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
Stop the emails promptly and record the withdrawal. The policy continues, and servicing messages are unaffected.
That is a purpose the TPA chose, not one the insurer set. It needs its own legal basis and the contract should forbid it unless agreed.
Check nominee arrangements and the policy contract. The Act lets a person nominate someone to exercise their rights.
Treat it as a possible breach, assess exposure, notify as required and review device security for distribution partners.
Name the insurers in the notice and obtain separate consent for lead sharing. Do not bundle it with the quote request.
Compliance checklist
Common mistakes to avoid
Treating the policy contract as permission to use data for any other purpose.
Letting agents and brokers keep customer lists with no controls.
Sharing claims data widely inside the company "for convenience".
Assuming TPAs and surveyors are covered by your policies without a written contract.
Keeping every lead and unsuccessful proposal forever.
Common questions
Is health data treated differently for insurers?
The Act has no separate sensitive-data category. All personal data follows the same rules, but health data is high-risk, so safeguards should match.
Do we need consent to process a proposal?
Data the proposer voluntarily provides for the stated purpose can be used for that purpose as a legitimate use. Anything beyond it, such as marketing, needs consent.
Does the DPDP Act override IRDAI rules?
No. Under Section 38 the Act applies in addition to other laws, so you follow both. If a provision of another law truly conflicts with the Act, the Act prevails to the extent of the conflict.
Are TPAs and brokers covered?
Yes. They are Data Fiduciaries or Data Processors depending on who decides the purpose of processing.
Can a customer delete their policy data?
Not where a law or the contract requires you to keep it. Section 12 lets you retain what is required, and you should tell the customer what and why.
What if an agent leaks customer data?
The insurer, as Data Fiduciary, stays responsible for processing done on its behalf, so agent contracts and controls matter.