Digital Trust · DPDP for Insurance

DPDP for insurers: health data, long retention and a hundred intermediaries.

For CISOs, compliance and data heads at life, health and general insurers. Underwriting and claims collect the most sensitive personal data in financial services, policies run for decades, and the data passes through agents, brokers, TPAs, hospitals and surveyors — every one of which is a processor you are accountable for.

Health data in underwritingIRDAI retentionTPAs & intermediariesClaims consentNominee & beneficiary data

Request a Insurance DPDP Assessment Run the Free Gap Assessment

Where this starts

What insurance teams usually discover in week one.

The privacy policy exists. The gaps are operational: what was collected under which consent, who it went to, and whether anyone can prove it. If three or more of these apply, a scoped gap assessment is the right first step.

Regulators & rule-sets in play

IRDAIInsurance Information BureauCERT-InData Protection Board

Sound familiar?

Proposal forms collect health and family history under a single declaration; there is no separate notice about who will see it.
TPAs, surveyors and network hospitals receive full claim files over email with no processor agreement covering deletion.
Policyholder data is retained for decades and nobody has defined what happens to declined proposals.
Agents and brokers hold customer data on personal devices and WhatsApp.
Nominees and beneficiaries are data principals who were never given notice.
Marketing renewals continue after a policyholder has asked to stop contact.

Personal data in scope

The data a Insurance organisation actually holds.

A DPDP programme starts with an honest inventory. These are the categories we typically find across insurance systems — each needs a purpose, a basis, an owner and a retention period.

Medical history, test results and prescriptions
Family and lifestyle disclosures
Nominee and beneficiary details
Claims documents including hospital records
Vehicle, property and asset details
Agent and intermediary records

Modern glass-walled office corridor representing insurer operations and policy administration

How the Act applies

DPDP obligations, translated for Insurance.

The Act is sector-neutral. Its impact is not. These are the obligations that carry the most weight for your workflows.

Heightened care for health and financial data

DPDP does not create a formal special category, but reasonable security safeguards are judged against sensitivity. Medical disclosures demand access controls, logging and minimisation.

Notice at proposal and at claim

Two collection points, two notices: what is collected, why, who will receive it (TPAs, hospitals, reinsurers), and how to exercise rights.

Intermediaries as processors

Agents, brokers, web aggregators, TPAs and surveyors act on your behalf. Contracts must define purpose, security, sub-processing, deletion and breach duties — and you must be able to evidence it.

Retention aligned to IRDAI and policy term

Policy records are kept for the term plus the regulator’s retention period; declined proposals and lapsed quotes need their own, shorter schedule.

Rights requests across a long lifecycle

Access and correction requests on a 20-year policy touch legacy systems. The workflow has to find and correct data everywhere it lives.

We keep legal specifics general on this page. Section-level analysis, penalty exposure and interpretation are worked through with your counsel during the engagement.

The hard part

Decades of mandated retention versus the right to erasure.

IRDAI requires policy and claims records to be maintained long after a contract ends; disputes and reinsurance recoveries extend that further. DPDP erasure applies only where no law requires retention — so the programme’s job is to separate mandated records from everything else.

How we resolve it

Policy, claims and complaint records classified as statutory-retention with the applicable direction recorded.
Marketing profiles, quote data for declined proposals and analytics derivatives placed on a consent-based schedule and erased on withdrawal.
Intermediary copies covered by contractual deletion terms once the purpose ends.
Erasure responses that state what stays, for how long and under which direction.

In your workflows

Where consent, notice and rights actually show up.

Proposal & underwriting

Layered notice covering medical data, tele-underwriting recordings and third-party checks; consent versioned against the proposal form.

Claims

Notice at claim intake; TPA and hospital data flows registered; claim-file access logged and restricted to the case team.

Distribution

Agent and broker onboarding with processor terms and device policy; lead data traced from aggregator to policy or deletion.

Servicing & renewals

Preference and withdrawal signals enforced across renewal campaigns; nominee notices at nomination change.

Want to know which of these is your biggest gap? The free assessment takes about ten minutes and scores seven compliance areas.

Run the Gap Assessment

Typical starting points

Three ways Insurance clients begin.

Scoped, time-boxed and designed to produce evidence early — so the board and the regulator see progress inside the first month.

First engagements

DPDP gap assessment across proposal, claims and distribution for one line of business
Intermediary and TPA processor-contract remediation with a register in Avisha Trust
Retention-vs-erasure matrix reconciled with IRDAI record-keeping requirements

How the programme runs

From gap assessment to continuous readiness.

Week 1–2 · Gap assessment

Data inventory, consent and notice review, vendor and rights-process review, breach readiness. Prioritised findings.

Week 3–6 · Remediation sprint

Notice and consent redesign, retention-vs-erasure matrix, vendor contract terms, breach playbook — highest-risk gaps first.

Week 7–12 · Operations

Rights-request workflow, consent logging and evidence store live in Avisha Trust; teams trained; first evidence pack produced.

Ongoing · Monitoring

Quarterly reviews, vendor re-assessment, AI-usage tracking and readiness reporting to the board.

Built for the Indian regulatory stack

We reconcile DPDP with the sector rules that already bind you, instead of importing a foreign template.

Security and compliance from one team

“Reasonable security safeguards” are tested by the people who run VAPT and incident response, not only described in policy.

Evidence, continuously

Avisha Trust captures consent, rights requests and attestations so the answer to “show me” is an export, not a project.

FAQ

DPDP for Insurance: questions we hear most

Yes. IRDAI’s guidelines are about security and governance of information assets. DPDP is about the individual’s rights over their personal data — consent, notice, access, correction, erasure, breach notification — and about your accountability for intermediaries. The overlap is real but incomplete.

It depends on who decides the purpose and means. A TPA adjudicating claims on your behalf is typically your processor; a hospital treating the patient is usually a fiduciary in its own right. We map each relationship and document the role, because the contract terms and your liability differ.

Collect only what the underwriting decision needs, tell the proposer who will see it, restrict and log access, and define retention for declined proposals separately from issued policies. Tele-underwriting recordings and medical test results need the same treatment.

A gap assessment on one line of business takes about three weeks given the number of intermediaries. Contract remediation and notice redesign typically run eight to twelve weeks, then monitoring. Group-wide programmes are phased by line of business.

Related sectors

Start with your sector’s pressure point.

Request a scoped Insurance DPDP assessment, or run the free gap assessment first.

Request a Insurance Assessment Free Gap Assessment