DPDP Compliance Guide for Insurance Companies

The Digital Personal Data Protection (DPDP) Act, 2023 is India’s framework for protecting digital personal data and regulating how organisations collect, use, share, store, and delete it.

For insurance companies, this means putting clear controls around how personal data is collected, used, shared, stored, and deleted across the insurance lifecycle. This includes lead generation, KYC, underwriting, policy servicing, renewals, claims, fraud detection, marketing, and interactions with agents, brokers, TPAs, and other third parties.

The DPDP Act, 2023 adds data protection requirements to an industry that already handles large volumes of personal, financial, health, and policy-related data. This guide explains the key DPDP compliance requirements for insurance companies, and how insurers can build practical controls across their core operations.

How Does the DPDP Act Affect the Insurance Industry?

The DPDP Act affects insurers because insurance operations depend heavily on digital personal data. Policy issuance, underwriting, claims, customer servicing, fraud detection, renewals, and distribution can all involve personal data processed by the insurer and multiple external parties.

The Act requires Data Fiduciaries to establish lawful processing, provide appropriate notices, maintain security safeguards, manage consent where applicable, respond to Data Principal rights, and fulfil additional obligations where an organisation is designated a Significant Data Fiduciary.

For an insurer, this means privacy controls must connect to actual business processes.

What changes for insurers?

Consider a health insurance proposal.

A customer may provide:

• Name and contact information
• Age and demographic information
• Identity and KYC information
• Medical history
• Diagnostic reports
• Existing policy information
• Financial information
• Nominee details
• Family-member information

That information may then move through:

Customer → Agent/Broker → Insurer → Underwriter → TPA → Hospital/Diagnostic Provider → Claims Team → Fraud Detection System → Reinsurer → Archive

Every arrow creates a governance question.

Who receives the data? Why do they receive it? What data do they actually need? What happens when the purpose ends?

This is where DPDP compliance insurance programs need to move beyond policies and spreadsheets.

How Should Insurance Companies Operationalise DPDP Compliance?

DPDP compliance for insurance companies should be operationalised across the complete insurance data lifecycle—not managed as a standalone privacy project. Insurers should connect data inventories, consent, notices, rights requests, retention, third-party governance, breach response, privacy assessments and audit evidence directly to underwriting, claims, servicing, distribution, marketing and other core processes.

The following controls should form the practical foundation of an insurance-specific DPDP program.

1. Map the Insurance Data Lifecycle

Start with the customer journey, not the organisation chart.

Map personal data from the first interaction through deletion.

A useful insurance lifecycle looks like:

Lead → Proposal → KYC → Underwriting → Policy Issuance → Servicing → Renewal → Claims → Fraud Detection → Analytics/Marketing → Retention → Deletion

For each stage, document:

• Data collected
• Source of data
• Purpose
• Legal basis
• System of record
• Internal users
• External recipients
• Storage location
• Retention period
• Deletion mechanism
• Applicable regulatory requirements

Do not stop at core policy administration systems.

Include:

• CRM platforms
• Claims systems
• Document repositories
• Agent portals
• Broker platforms
• TPAs
• Surveyors
• Call-centre systems
• Email
• Messaging platforms
• Marketing automation
• Analytics platforms
• Data lakes
• Cloud storage
• Backups
• Legacy applications
• Shadow databases

If the privacy team cannot draw the data flow, the organisation probably cannot defend the data flow during an audit.

2. Redesign Proposal Forms and Consent Management

Proposal forms are one of the most important collection points in insurance.

A single digital form can potentially collect identity, contact, health, financial, family and policy-related information.

The risk appears when one broad consent mechanism silently covers multiple unrelated purposes.

For example: “I agree to the processing and sharing of my information for insurance, marketing, offers, partner services and other purposes.”

That may create questions around transparency, purpose specification and consent management.

Under the 2025 Rules, notices are expected to be presented independently and in clear, plain language, with an itemised description of personal data and specified purposes. It also requires mechanisms for withdrawal of consent and exercise of rights to be accessible through the specified channels.

Insurance companies should therefore assess:

• Proposal forms
• Mobile applications
• Website forms
• Agent-assisted forms
• Call-centre scripts
• Digital KYC journeys
• Renewal journeys
• Marketing opt-ins
• Partner journeys

The key question is: Can the insurer distinguish consent for the insurance service from consent for optional purposes such as marketing?

3. Review Data Processing in Insurance Underwriting

Underwriting is one of the most data-intensive insurance activities.

Depending on the product, insurers may assess:

• Age
• Health history
• Lifestyle information
• Financial information
• Previous claims
• Property information
• Vehicle information
• Risk characteristics
• External data sources

The privacy review should identify exactly what data underwriters need and whether every collected field is justified.

Ask:

• Which data fields influence underwriting?
• Which are mandatory?
• Which are optional?
• Which third parties provide information?
• Is information reused for another purpose?
• How long is underwriting data retained?
• Who can access medical information?
• How is access logged?
• What happens when an application is rejected?

This becomes even more important when insurers introduce automated decisioning or AI-based underwriting.

4. Build DPDP Controls Into Insurance Claims Processing

Claims generate another complex data environment.

A health claim could involve: Policyholder → Insurer → TPA → Hospital → Doctor → Diagnostic centre → Surveyor → Investigator → Claims assessor → Reinsurer

Motor claims may involve: Policyholder → Insurer → Surveyor → Garage → Manufacturer/service network → Investigator → TPA/other service providers where applicable

Each participant may receive different information.

The insurer should therefore maintain a clear record of:

• Who receives claims data
• What information they receive
• Why they receive it
• Whether they determine the purpose or merely process on the insurer's behalf
• What contractual controls apply
• What security controls apply
• How long they retain information
• How information is deleted or returned

Do not assume that every TPA or service provider automatically has the same legal role. The relationship should be assessed based on the actual purpose and means of processing.

5. Review TPAs, Brokers, Agents and Other Insurance Intermediaries

Third-party governance is one of the biggest operational challenges for DPDP compliance insurance programmes.

The insurance ecosystem can include:

• TPAs
• Insurance brokers
• Corporate agents
• Individual agents
• POSPs
• Surveyors
• Hospitals
• Diagnostic centres
• Garage networks
• Aggregators
• Call centres
• Cloud providers
• Analytics providers
• Marketing providers
• Fraud-detection vendors
• Reinsurers

Ask a simple question: Where is the customer's data first collected?

This is especially important when agents, brokers, POSPs, or other intermediaries collect information on behalf of or in connection with the insurer.

For example, an agent may:

• Download a proposal form
• Save an identity document
• Store a medical report
• Export a customer list
• Keep customer information on a personal device
• Share documents through messaging applications
• Retain customer information after policy issuance
• The insurer should have visibility into these collection points and control how the data is accessed, transferred, stored, and deleted.

Key controls should cover:

• Approved data collection channels
• Access permissions
• Device and data security
• Secure data transfer
• Third-party contracts
• Retention and deletion
• Audit trails
• Incident escalation

6. Create an Insurance-Specific Data Retention and Deletion Framework

Insurance companies often have long-lived records.

A policy may last for years. A claim may remain under investigation. Certain records may need to be retained because of applicable regulatory, legal or contractual requirements.

The solution is not simply: “Delete everything when the policy ends.”

Instead, create a purpose- and obligation-based retention schedule.

For each data category, record:

• Collection purpose
• Business owner
• Applicable regulatory/legal requirement
• Active-use period
• Retention period
• Legal hold conditions
• Deletion trigger
• Deletion method
• Downstream systems affected
• Vendor deletion requirements

Retention is not unrestricted reuse.

Suppose a customer record must be retained for a regulatory reason.

That does not automatically answer whether the same information should remain available to a marketing team.

Separate: Why must we retain it?

from:

Why are we still using it?

This distinction can significantly improve privacy governance.

7. Separate Insurance Operations from Marketing and Cross-Selling

Marketing is an easy place for insurance data purposes to expand without anyone noticing.

Consider this data chain: Insurance CRM → Marketing Automation → WhatsApp/SMS/Email → Ad Platform → Retargeting → Analytics

Now ask:

• Where did the customer list come from?
• Was the customer informed about the marketing purpose?
• What consent or another lawful basis applies?
• Is policy data used for targeting?
• Is claims information used for marketing?
• Are old policyholders still being marketed to?
• Are customer lists shared with partners?
• Does withdrawal propagate across marketing systems?
• Are lookalike audiences created from customer data?
• Can the insurer prove the provenance of the marketing list?

A customer purchasing health insurance does not automatically mean every piece of health or policy information should become available to the marketing function.

Purpose limitation needs to survive organisational boundaries.

8. Govern Telematics, Wearables and Usage-Based Insurance

Connected insurance products create new categories of data.

Examples include:

• Vehicle telematics
• Driving behaviour
• GPS/location information
• Wearable information
• Health measurements
• Activity patterns
• Usage data

For usage-based insurance, insurers should establish:

• What data is collected
• How frequently it is collected
• Why it is required
• How the information affects premiums or eligibility
• Which third parties receive it
• How long it is retained
• What happens if the customer withdraws consent where consent is the applicable basis
• Whether historical data continues to be used

The principle is simple: Do not collect continuous data merely because the technology makes continuous collection possible.

9. Review AI-Based Underwriting, Fraud Detection and Analytics

AI can increase insurance efficiency, but it can also multiply privacy and governance risks.

Potential applications include:

• Automated underwriting
• Fraud detection
• Claims triage
• Risk scoring
• Customer segmentation
• Predictive analytics
• Personalised offers
• Document processing

For every AI system, insurers should document: Data → Purpose → Model → Decision/Output → Human oversight → Retention

Questions should include:

• What personal data trains or operates the system?
• Is the data necessary?
• What is the source?
• Is historical customer data reused?
• Are outputs used for decisions affecting individuals?
• Who can access model inputs?
• How long are inputs and outputs retained?
• Can the organisation explain the data used by the system?

AI governance should be integrated into privacy assessments rather than treated as a completely separate technology exercise.

10. Align Data Breach Response with DPDP and IRDAI Requirements

Insurance companies already need mature cyber incident processes.

DPDP adds another privacy dimension.

The organisation must be able to identify:

What happened → What data was affected → Whose data was affected → Which systems were involved → Which third parties were involved → What notifications are required → What evidence exists

IRDAI's regulatory framework also addresses information and cybersecurity, including implementation and cyber incident preparedness.

A useful insurance breach playbook should connect:

• SOC alerts
• Incident response
• Privacy assessment
• Claims/customer impact assessment
• Vendor escalation
• Regulatory assessment
• Data Principal communication
• Evidence preservation
• Corrective actions

The goal is not to create a second incident-response process.

It is to connect the privacy response to the insurer's existing cyber-response architecture.

11. Assess Reinsurance and Cross-Border Data Flows

Reinsurance creates another layer of data movement.

An insurer may need to share information with:

• Indian reinsurers
• Foreign reinsurers
• Global service providers
• International analytics providers
• Claims investigators
• Cloud infrastructure providers

Map:

• What data leaves the organisation
• Which entity receives it
• Why it is transferred
• Where it is stored
• What contractual controls apply
• What security measures apply
• What DPDP requirements apply
• Whether any government restrictions or other applicable laws affect the transfer

Do not assume that a data flow is acceptable simply because it has existed for years.

Legacy does not mean compliant.

12. Assess Whether the Insurer Could Be a Significant Data Fiduciary

Not every insurer should be described as a Significant Data Fiduciary automatically.

The DPDP framework provides for designation based on prescribed factors and government notification.

However, insurers should assess the possibility because the SDF framework introduces additional governance expectations.

Organisations should be prepared to evaluate:

• Scale of processing
• Volume and nature of personal data
• Risk to Data Principals
• Impact of processing
• Use of emerging technologies
• Other prescribed factors

If designated, the organisation needs to prepare for additional obligations such as appointing a Data Protection Officer, conducting assessments and audits, and meeting other prescribed requirements.

The right question is not “Are insurers SDFs?”

It is: “Could our organisation be designated, and are our governance controls mature enough if that happens?”

13. Build DPDP Into New Insurance Products and Processes

Privacy should not be reviewed only after a new insurance product goes live.

Create a privacy gate for:

• New insurance products
• Mobile applications
• Digital proposal forms
• Telematics products
• Wearable-based insurance
• AI underwriting
• Automated claims
• New marketing campaigns
• New TPAs
• New brokers
• Embedded insurance partnerships
• New analytics platforms

Before launch, ask:

1. What personal data is collected?
2. Why is it required?
3. What is the applicable legal basis?
4. What notice does the customer receive?
5. Who receives the information?
6. How long is it retained?
7. What happens when consent is withdrawn, where applicable?
8. How will Data Principal rights work?
9. What security controls apply?
10. What evidence will be maintained?

This is Privacy by Design for insurance.

14. Build Audit Evidence for Every Major DPDP Control

A policy saying that a control exists is not the same as proving that it operates.

Insurance companies should create an evidence trail.

The audit trail should answer who did what, when, why, and under which policy or control.

What Should Insurance Companies Prioritise Before May 2027?

The 2025 Rules establish an 18-month implementation period for the principal operational rules, placing the major compliance milestone in May 2027. The one-year provision for Consent Managers has a separate timeline.

Insurance companies should use this period to build operational capability rather than wait for the deadline.

Phase 1: Discover

Objective: Know your data.

Complete:

• Personal-data inventory
• Insurance lifecycle mapping
• System discovery
• Third-party mapping
• Agent/broker data-flow mapping
• Claims data mapping
• Marketing data mapping
• Reinsurance and cross-border mapping
• Legacy-system assessment

Output: Current-state data map and risk register.

Phase 2: Design

Objective: Define how data should be governed.

Create:

• Purpose register
• Data classification approach
• Privacy notices
• Consent architecture
• Retention schedule
• Deletion rules
• Rights-request procedures
• Third-party governance framework
• Privacy assessment methodology
• Breach-response integration

Output: Target-state privacy operating model.

Phase 3: Implement

Objective: Put controls into business processes.

Implement:

• Consent workflows
• Notice management
• Data Principal request workflows
• Data mapping
• Vendor assessments
• Contractual controls
• Retention automation
• Deletion workflows
• Breach workflows
• Audit logging
• Training

Output: Operational DPDP controls.

Phase 4: Test

Objective: Prove the controls work.

Run scenarios such as:

• Customer withdraws consent
• Customer submits a rights request
• Policy expires
• Claim remains under investigation
• Vendor relationship ends
• Agent loses access
• TPA data must be deleted
• Marketing consent is withdrawn
• Customer data is discovered in a legacy system
• A breach affects a third party
• New insurance product is launched

Output: Tested controls and remediation records.

Phase 5: Monitor

Objective: Keep compliance operational.

Monitor:

• New products
• New vendors
• New data sources
• AI use cases
• Marketing campaigns
• Regulatory changes
• Data breaches
• Retention exceptions
• Rights requests
• Consent withdrawal
• Third-party compliance
• Audit findings

DPDP compliance should become part of the insurer's operating rhythm—not a one-time implementation project.

Conclusion

DPDP compliance for insurance companies is about putting privacy controls into the processes that collect, use, share, and retain customer data. This includes underwriting, claims, policy servicing, marketing, third-party relationships, AI systems, reinsurance, and legacy applications.

The right approach is practical: map the data, define the purpose, assign controls, test them, and maintain evidence. Insurers that start now can identify gaps, strengthen third-party governance, improve data flows, and build DPDP into new products and processes before the major obligations take effect.

DPDP compliance should become part of the insurer’s operating model—not a last-minute compliance exercise.

Key Takeaways

• DPDP requires insurers to protect personal data across the insurance lifecycle.
• Insurers should map data from collection to use, sharing, retention, and deletion.
• Proposal forms and consent practices should clearly explain how customer data is used.
• Underwriting and claims processes need clear controls for data access, use, and retention.
• Agents, brokers, TPAs, and other intermediaries must be included in data governance.
• Retention and deletion should be based on clear business, legal, and regulatory requirements.
• Marketing, telematics, AI, and analytics require clear purposes and appropriate data controls.
• Insurers should manage data breaches, reinsurance transfers, and cross-border data flows as part of their privacy programme.
• New insurance products, technologies, and partnerships should include privacy checks before launch.
• Insurers should maintain evidence that their DPDP controls are working.
• A practical DPDP roadmap should follow five stages: Discover, Design, Implement, Test, and Monitor.

Related Blog

Liked the post? Share on:

FacebookWhatsAppLinkedInX