DPDP Act for Insurance Companies: A Compliance Guide
TL;DR
Insurers process health, financial and family data at scale, through long chains of agents, brokers, banks, TPAs and hospitals. The DPDP Act applies on top of IRDAI rules. Policy and claims processing can generally rely on data customers provide for that purpose, but cross-selling, lead buying and intermediary sharing need care. Records rules from IRDAI survive erasure requests, and large insurers should prepare as likely Significant Data Fiduciaries.
Who this is for: compliance heads, DPOs, CISOs and legal teams at life, general and health insurers, brokers, corporate agents, web aggregators and TPAs.
Insurance runs on some of the most sensitive personal data in the economy. A single health policy can involve medical history, test reports, income, family members and nominees, flowing through agents, banks, brokers, aggregators, TPAs and hospitals. The DPDP Act applies to all of it, on top of IRDAI's existing rules.
This guide covers what changes. For lenders and bancassurance partners, also see DPDP for banks and NBFCs; for hospitals in the claims chain, see DPDP for healthcare.
Who is the fiduciary in the insurance chain
| Party | Typical role |
| Insurer | Data Fiduciary for proposal, policy, premium and claims data |
| TPA processing claims for an insurer | Processor for that activity |
| Corporate agent (e.g. a bank) selling the insurer's policies | Often acts for the insurer; may be a fiduciary for its own customer relationship |
| Broker acting for the customer | Often a fiduciary in its own right |
| Web aggregator | Fiduciary for its own lead and comparison data |
| Hospital in a cashless claim | Fiduciary for treatment data; shares claim information with the insurer/TPA |
Map roles per activity and reflect them in contracts. See Data Fiduciary vs Data Processor.
Lawful basis for core insurance processing
Proposal, underwriting, issuance, servicing and claims can generally rely on data the customer voluntarily provides for that purpose (Section 7(a)), supported by a clear notice of what is collected and why. The insured person, nominees and family members included on a policy are also Data Principals. Tell the proposer what data about them is processed.
Activities that typically need consent:
- cross-selling other policies or group-company products
- marketing to past or lapsed policyholders
- sharing data with partners for their own purposes
- wellness programmes that collect ongoing health or activity data
See valid consent under DPDP and marketing consent.
Purchased leads and aggregators
Insurance distribution relies heavily on leads from aggregators and affiliates. Under the DPDP Act, you need evidence that each lead consented to being contacted by you, for this purpose. Require consent records from lead partners contractually, spot-check them, and do not use leads you cannot evidence.
Health data and minors
The DPDP Act has no separate category for health data, but insurers' penalties and SDF risk reflect its sensitivity. Restrict access to medical information to underwriting and claims staff, keep it separate from marketing systems, and keep only what is needed. For policies covering children, consent-based processing requires verifiable parental consent, and targeted advertising directed at children is prohibited (Section 9).
Retention and IRDAI records rules
IRDAI's record-maintenance regulations require insurers to keep policy and claims records for long periods and to hold records in India. Section 8(7) preserves retention required by law, so these records can be kept for the mandated period, then erased. Everything not covered, such as unconverted leads, marketing data, call recordings kept for convenience, and wellness data after a programme ends, must be erased when its purpose ends. See data retention policy.
Security and breaches
IRDAI's cyber security guidelines already require strong controls and incident reporting. The DPDP Act adds notice to every affected individual and the Data Protection Board without delay, and a detailed report within 72 hours, with no materiality threshold. Run one incident process covering IRDAI, CERT-In and Rule 7. See the Rule 7 playbook.
Intermediaries and vendors
TPAs, call centres, investigators, medical examination providers and cloud vendors all process policyholder data. Under Section 8(1), the insurer remains responsible. Put DPDP terms in every contract: safeguards, breach notice, rights support, erasure and locations. See vendor risk under DPDP.
Significant Data Fiduciary readiness
Large insurers process high volumes of sensitive financial and health data, key factors under Section 10. Prepare for a DPO based in India, an independent data auditor and annual DPIAs and audits. See Significant Data Fiduciary.
Insurance DPDP checklist
Insurance DPDP checklist
- Roles mapped across agents, brokers, aggregators, TPAs and hospitals
- Proposal and claims notices covering insured persons and nominees
- Separate consent for cross-selling, marketing and partner sharing
- Consent evidence required from lead partners
- Health data access restricted and segregated
- Retention schedule reconciling IRDAI rules and DPDP erasure
- DPDP terms in TPA and intermediary contracts
- Single incident process for IRDAI, CERT-In and Rule 7
- SDF readiness assessed
How ConsentifyAI helps insurers
ConsentifyAI captures consent per purpose across branch, agent, bancassurance and digital journeys, records lead-partner consent evidence, applies retention rules that respect IRDAI record requirements, and keeps a tamper-evident audit trail for regulators and the Data Protection Board.
Sources & references
- DPDP Act, 2023 — Section 6, 7(a)
- DPDP Act, 2023 — Section 8(1), 8(2), 8(6), 8(7)
- DPDP Act, 2023 — Section 9, 10, 16(2), 38
- DPDP Rules, 2025 — Rules 3, 6, 7, 13
- Other — IRDAI regulations on maintenance of insurance records; IRDAI Information and Cyber Security Guidelines
Frequently asked questions
Does the DPDP Act apply to insurance companies?
Yes. Insurers are Data Fiduciaries for the policyholder, proposer, insured and claimant data they process. IRDAI rules continue to apply alongside the Act.
Do insurers need consent to process claims?
Data the policyholder or claimant provides to obtain cover or settle a claim can generally be processed for that purpose under Section 7(a). New purposes such as cross-selling need consent.
Are agents, brokers and TPAs processors?
It depends on the activity. A TPA processing claims for an insurer is typically a processor. Brokers acting for customers may be fiduciaries in their own right. Map roles and contract accordingly.
Can policyholders ask insurers to delete their data?
Records that IRDAI regulations or other laws require insurers to keep can be retained for the required period (Section 8(7)). Other data must be erased when no longer needed.
Do IRDAI localisation rules still apply?
Yes. Section 16(2) preserves sector rules that impose stricter requirements on where data is held.
Related reading
DPDP Act for Banks and NBFCs: A Compliance Guide
Banks and NBFCs face the DPDP Act on top of RBI, PMLA and credit information rules, not instead of them. Retention required by law survives the DPDP erasure duty (Section 8(7)), but everything else must be erased when its purpose ends. Cross-selling, bureau sharing and app permissions need clear notices and, where consent is the basis, unbundled consent. Large lenders should prepare as likely Significant Data Fiduciaries. Being RBI-compliant does not make a lender DPDP-compliant.
ReadDPDP Act for Healthcare: A Compliance Guide for Hospitals, Labs and Health Apps
The DPDP Act does not create a special category for health data, but healthcare is one of its most exposed sectors. Treatment data patients provide can usually be processed for that purpose, and emergencies have their own legitimate use. Hospitals and doctors are exempt from verifiable parental consent only for health services to a child (Rule 12 and Fourth Schedule). Marketing, analytics pixels, health apps and research need careful treatment, and ransomware makes breach readiness essential.
ReadThird-Party Vendor Risk Under DPDP: Your Vendor's Breach Is Your Breach
Under Section 8(1) of the DPDP Act, a Data Fiduciary is responsible for compliance even when a vendor does the processing. Processors may only be engaged under a valid contract (Section 8(2)), and Rule 6 requires security safeguards to be written into it. Withdrawals, erasure and breaches all have to flow through your vendors on time. Effective vendor risk management means knowing every vendor, tiering them by risk, contracting properly, and monitoring continuously, not just at onboarding.
Read