- Home
- Industries
- DPDP for insurance
Industry
DPDP for insurance
A policy collects identity, health and financial data at proposal, more at every claim, and keeps much of it for years. Agents, brokers and administrators handle it along the way.
Short answer
Insurers are Data Fiduciaries for policyholder data, with notice, consent, security, breach and rights duties starting 13 May 2027 (Rule 3, Rule 6, Rule 7, Rule 14). Agents, brokers and third-party administrators that process data on an insurer's behalf need valid contracts (s.8(2)), and the insurer stays responsible for them. Records a law requires you to keep may be kept (s.8(7)); check your regulator's directions alongside DPDP, and treat CERT-In's 6-hour reporting of specified cyber incidents as separate from Rule 7.
Where personal data sits in insurance
- Proposals: name, age, PAN, Aadhaar, address, income, nominee details and health declarations.
- Underwriting: medical test reports, and prior policy and claims history.
- Policy servicing: payment mandates, bank details for payouts, and endorsements.
- Claims: hospital bills, discharge summaries, accident reports, photos and investigator notes.
- Distribution: data held by agents, brokers, bank partners and online aggregators.
- Third-party administrators and hospitals: cashless claim data passed back and forth.
- Nominees and family members: personal data of people who are not your customer.
Claims files grow fastest. A single claim can hold documents about the policyholder, a patient, a driver, witnesses and hospital staff, and each of them is a Data Principal. Decide early which of those documents you need to keep, and for how long.
DPDP duties that bite hardest
| Duty | Section or rule | What it means in this sector |
|---|---|---|
| Notice and consent | s.5, s.6, Rule 3 | One proposal form often collects for underwriting, cross-sell and marketing. Itemise the purposes and keep marketing optional. |
| Data about others | s.4 | Nominee and family data arrives through the proposer. Decide your lawful ground for it and use it only for the policy. |
| Accuracy | s.8(3) | Underwriting and claims decisions rely on personal data, so it must be complete, accurate and consistent. |
| Retention against erasure | s.8(7) | Erase when the purpose is served, unless a law requires you to keep the record. Rejected proposals and settled claims need defined periods. |
| Security safeguards | s.8(5), Rule 6 | Masking, access control, logs kept a year, and security terms in every agent, broker and administrator contract. |
| Breach intimation | Rule 7 | Intimate affected policyholders and the Board without delay, and give the Board a detailed report within 72 hours. |
| DPDP nomination | s.14, Rule 14 | A person can nominate someone to exercise her data rights on death or incapacity. This is separate from a policy nominee. |
Roles: fiduciary or processor
The insurer is the fiduciary for its policyholders. Third-party administrators, call centres, cloud vendors and investigators that act on its instructions are usually processors, so they need contracts and due diligence.
Agents and brokers need a closer look. Where a broker advises the customer and decides its own uses of the customer's data, it may be a fiduciary in its own right. Agree roles in writing and check them with counsel.
The same question applies to bank partners that sell your policies. Decide whether the partner collects proposal data for you or for its own purposes too, and make the notice say so.
Check your regulator's directions alongside DPDP, especially on record keeping. CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents to CERT-In within 6 hours, separately from Rule 7.
A 90-day starting plan
- 01Days 1 to 30: map proposal to claim
Trace data from proposal through underwriting, servicing and claims. List every distributor and administrator that receives it, and where copies sit.
- 02Days 31 to 60: contracts and retention
Put processor terms with security and breach reporting clauses in place. Set a retention period per record type, with the legal basis for each.
- 03Days 61 to 90: rights and breach
Publish how to make requests and your grievance response period. Rehearse a breach that starts in a partner's systems.
How TruePrivacy helps
- Classification detects PAN, Aadhaar, ABHA numbers, IFSC and Indian mobile numbers, and the data classes view lists the most sensitive data first, with high-risk stores.
- Vendors and processors covers agents, brokers and administrators with risk levels, vendor portal assessments, a breach reporting question template and contract tracking.
- Retention applies rules per data category, logs each execution and flags items that need a manual purge.
- Data Principal requests handle access, correction, erasure, consent withdrawal and nomination, and grievance redressal runs the 90-day clock.
- Breach management runs the Rule 7 clocks. It has no CERT-In track.
Is a DPDP nominee the same as a policy nominee?
No. Under s.14, a Data Principal can nominate someone to exercise her DPDP rights on death or incapacity. A policy nominee is a separate concept, outside DPDP.
Can policyholders ask us to erase their data?
They can request erasure (s.12). Where a law requires you to keep records, s.8(7) lets you keep them for that purpose; explain this in your response.
Are third-party administrators processors?
Usually, where they process claims data on the insurer's instructions. Confirm the role in the contract.
Does CERT-In reporting count as Rule 7 intimation?
No. They are separate duties with different recipients and timings. Plan both.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin