Insurance companies process the most sensitive personal data in the financial sector — health records, financial history, family details, and nominee information. Under the DPDP Act 2023, insurers must obtain purpose-specific consent for each data use, restrict sharing with reinsurers and agents through DPAs, and provide a clear privacy notice at policy inception. IRDAI's data localisation requirements add an additional compliance layer for insurance data.
DPDP compliance insurance India — Complete DPDP Compliance Guide
Insurance companies process health data, financial information, and claim details — among the most sensitive categories under DPDP Act 2023.
Quick AnswerInsurers must obtain explicit consent before using health and financial data for underwriting, restrict data sharing with third-party brokers, implement data minimisation in proposal forms, and comply with IRDAI-DPDP intersection requirements.
DPDP Compliance Checklist
Map all data flows: proposals, underwriting, claims, renewals, and agent channels
Obtain explicit consent for health data use in underwriting — general terms are insufficient
Restrict sharing policyholder data with third-party brokers without explicit consent
Review telematics (motor insurance) and wearable (health insurance) data practices
Implement data retention schedule: retain only what is legally required post-claim settlement
Publish clear privacy notice in policy documents and online portal
Train agents, brokers, and customer service teams on DPDP data handling
Implement DSAR workflow — respond to policyholder data access requests within 30 days
Align with IRDAI data governance guidelines — check for DPDP-IRDAI overlap
Conduct annual DPDP impact assessment across all insurance product lines
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Is health data in insurance proposals sensitive under DPDP?+
Yes. Health data is the most sensitive category. Insurers must obtain specific, informed consent before collecting and processing health information for underwriting.
Can insurers use claims data for pricing?+
Aggregate claims data for actuarial pricing is generally permissible. However, using individual policyholder claims history for personalised pricing requires explicit consent.
How does IRDAI DPDP intersection work?+
IRDAI regulations and DPDP complement each other. Where IRDAI mandates specific data handling, that prevails. Where DPDP is stricter (e.g., consent), DPDP governs.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
