In late 2023, the Insurance Regulatory and Development Authority of India (IRDAI) formed an eleven-member task force to assess how the Digital Personal Data Protection (DPDP) Act would reshape the sector. In February 2025, it reconstituted its Inter-Disciplinary Standing Committee on Cyber Security for the same purpose. What neither exercise resolved is how the DPDP Act’s obligations sit alongside IRDAI’s own, pre-existing rules on data protection and cyber security.
From underwriting through to claims settlement, insurers process health records, financial history, family details, and identity documents across the full policy lifecycle, often for decades. With the DPDP Act’s enforcement architecture now taking shape alongside IRDAI’s existing regulatory framework, insurers are working through two sets of obligations that were built separately but must now function together.
This creates a practical question for insurers: where do existing IRDAI controls already address DPDP requirements, and where do organisations need to introduce new of strengthened measures?
Where IRDAI’s data rules meet DPDP
Insurers have operated under data protection obligations for years, largely through Regulation 19(5) of the IRDAI (Protection of Policyholders’ Interests) Regulations, 2017, and IRDAI’s Guidelines on Information and Cyber Security for Insurers.
However, the DPDP Act introduces obligations IRDAI’s framework does not fully cover, including a defined consent architecture, data principal rights such as access and erasure, and fiduciary accountability that runs independently of sector-specific rules.
This distinction is important because the two frameworks do not simply duplicate one another. IRDAI’s requirements apply within the specific regulatory and operational context of insurance, while the DPDP Act establishesbroader obligations governing the processing of digital personal data. An insurer therefore needs to assess its existing controls against both frameworks rather than assume that compliance with one automatically satisfies the other.
Section 8(1) also requires Data Fiduciaries to implement reasonable security safeguards to prevent personal data breaches, with regulators looking at whether this obligation is enforced operationally, not just documented.
For an insurer, these obligations play out in specific ways:
- Consent captured at policy issuance needs to hold up under DPDP’s stricter standard, not just IRDAI’s existing disclosure norms
- Where insurers use intermediaries, TPAs, brokers, technology providers or other third parties, the organisation needs to establish whether the third party is acting as a Data Processor or Data Fiduciary for the relevant processing activity and apply the appropriate contractual and governance controls.
- Data shared with intermediaries, Third Party Administrators (TPAs), and network hospitals needs contractual and technical controls that satisfy both frameworks, since TPAs already sit under restrictions on sharing policyholder information
- Large insurers, particularly life insurers with high policyholder volumes, are realistic candidates for designation as Significant Data Fiduciaries under Section 10, which would bring mandatory Data Protection Impact Assessments and annual audits
The practical risk is fragmentation where compliance teams satisfy IRDAI’s checklist while leaving DPDP-specific gaps in consent language, retention limits, and data principal rights unaddressed.
The objective should therefore be a joined-up control framework: identifying where an existing IRDAI control can also satisfy a DPDP requirement, where it needs to be strengthened, and where DPDP introduces a requirement that has no direct equivalent under the existing insurance framework.
One breach, two notification regimes
IRDAI’s Cyber Security Guidelines already require insurers to report qualifying cyber incidents, including data breaches, within six hours of detection. The DPDP Act layers a separate obligation on top: Section 8(6) requires notification to both the Data Protection Board of India and affected Data Principals without undue delay, and Rule 7 of the DPDP Rules 2025 sets a 72-hour deadline for a detailed report to the Board, measured from awareness of the breach.
An insurer that treats the six-hour IRDAI report as the end of its notification obligation is misreading its position. The two clocks run in parallel on the same underlying incident, not in sequence, and they serve different regulators with different expectations.
This is one of the clearest examples of where sector-specific regulation and the horizontal DPDP framework intersect: a single incident can give rise to distinct notification obligations under both regimes.
Practically, this means:
- Incident response plans need a single detection-to-notification workflow that triggers both the IRDAI report and the DPDP Board report, rather than two teams working from separate playbooks
- Individual notification to affected policyholders, often the most operationally complex step given policyholder volumes, needs to be pre-drafted and legally reviewed so it doesn’t become the bottleneck against “without undue delay”
- The moment of “awareness” needs to be logged systematically, since it is the anchor point for the 72-hour Board deadline and something regulators will expect an insurer to be able to demonstrate
The financial consequences of non-compliance
The DPDP Act’s Schedule sets monetary penalties of up to ₹250 crore per instance for failure to implement reasonable security safeguards, with separate, additive penalties for notification failures. The Data Protection Board determines the amount based on the gravity of the breach, duration of exposure, sensitivity of the data involved, and whether the organisation exercised due diligence. For insurers, the exposure compounds; a single breach can implicate both DPDP penalties and separate consequences under IRDAI’s own regulatory framework, since the same incident triggers obligations to two regulators simultaneously.
To be in a defensible position before an incident occurs, insurers need:
- Continuous monitoring of access to policyholder health, financial, and identity data, particularly where TPAs and intermediaries hold shared access
- Log management that is independently validated and forensically reliable, given the volume and lifecycle length of insurance data
- Notification workflows rehearsed against both the IRDAI six-hour window and the DPDP 72-hour Board deadline, not just one or the other
Cross-border data and reinsurance arrangements
Reinsurance is where insurers face a distinctive cross-border exposure that most sectors don’t.
Facultative and treaty arrangements routinely involve transferring policyholder data to reinsurers based outside India. The DPDP Act adopts a permissive model for cross-border transfers under Section 16, allowing them unless the government specifically restricts particular jurisdictions. But a detailed cross-border transfer framework is still being operationalised. Until it is, IRDAI’s existing data localisation requirements for certain categories of policyholder data provide a starting point, but they don’t address every scenario a reinsurance arrangement can create.
In the interim, insurers should:
- map all overseas data transfers tied to reinsurance treaties and facultative arrangements,
- review the contractual safeguards already in place, and
- confirm that what’s being transferred is limited to what the reinsurance purpose actually requires.
A breach involving data processed by an overseas reinsurer doesn’t reduce the Indian entity’s notification and governance obligations; those apply to the Indian operations regardless of where the data physically sits.
Why this needs dedicated ownership
The structural overlap between IRDAI’s sector-specific rules and the DPDP Act’s general obligations means insurers can’t compliance-check their way through this with existing teams working in parallel.
The issue is not simply assigning responsibility for “privacy” to one team and “IRDAI compliance” to another. The same processing activity may sit within both regulatory frameworks, making clear ownership and coordination essential.
A Data Protection Officer (DPO) with working expertise across both frameworks, and ideally the GDPR as well given how many insurers already manage reinsurance and outsourcing relationships with GDPR-bound counterparties, can identify where IRDAI’s existing controls already satisfy DPDP requirements, where they fall short, and where insurance-specific obligations (SDF designation, TPA data sharing, reinsurance transfers) need a response built from scratch.
Practical next steps
The starting point is a structured gap analysis across four areas specific to the insurance sector:
- Consent and data principal rights across the policy lifecycle
- Dual-track incident notification covering both IRDAI and DPDP timelines
- Cross-border data flows in reinsurance arrangements
- Readiness for potential Significant Data Fiduciary obligations.
This assessment should begin with a mapping exercise: identify the relevant processing activities, the parties involved, the applicable DPDP roles and the corresponding IRDAI requirements, before testing whether existing controls meet both sets of obligations.
The analysis is therefore benchmarked against both IRDAI’s regulatory framework and the DPDP Act specifically.
The DPO’s role is to provide independent privacy oversight across all functions, ensuring that the organisation’s approach to IRDAI and DPDP requirements is joined up.
Understanding how the two frameworks fit together is the starting point. Turning that understanding into practical controls, workflows and accountability is the next step.
HewardMills works with insurers and other regulated financial services organisations on DPDP compliance readiness, incident response frameworks, and data governance assessments. Contact our team to discuss your organisation’s current position and see how we can support you.
