The interaction between India’s Digital Personal Data Protection (DPDP) Act and the Insurance Regulatory and Development Authority of India’s (IRDAI) regulatory framework is creating a new compliance landscape for insurers and insurance intermediaries.
In our first article, here, we looked at the practical implications of this overlap; from data governance and breach notification to third-party risk and cross-border data flows. But before insurers can determine what needs to change, it is important to understand how the two frameworks fit together.
The DPDP Act establishes a horizontal, cross sector framework governing the processing of digital personal data across India, while IRDAI’s regulations impose sector-specific requirements on insurers and insurance intermediaries. They are not simply two versions of the same rules: they operate at different levels and can apply to the same processing activity in different ways.
This distinction matters because the DPDP Act does not specifically regulate “insurers” as a category. Instead, its obligations attach according to the role an organisation or individual plays in relation to personal data. IRDAI’s framework, by contrast, is built around regulated insurance entities and the activities they undertake.
Understanding these different regulatory perspectives provides the foundation for assessing where requirements overlap, where they remain distinct, and how responsibilities should be allocated across the insurance ecosystem.
Mapping key stakeholders
One of the clearest ways to understand the overlap between the two frameworks is by mapping the roles defined under the DPDP Act to entities within the insurance ecosystem.
The DPDP Act does not specifically mention insurers or insurance intermediaries. The mapping below is therefore an interpretation based on the statutory definitions and the nature of the relevant processing activity:
| Insurance Ecosystem | DPDP Act role | Explanation |
| Insurers | Data Fiduciaries | Insurers determine the purpose and means of processing policyholders’ personal data for underwriting, claims management, customer servicing, fraud detection, regulatory reporting, and other insurance operations.
|
| Insurance Intermediaries (brokers, agents, TPAs, web aggregators, etc.) | Data Processor or Data Fiduciary | Depending on their role, intermediaries may process data solely on behalf of insurers, acting as Data Processors, or independently determine the purpose and means of processing, acting as Data Fiduciaries. Their classification depends on the nature of the processing activity rather than simply the type of entity.
|
| Policyholders, nominees, beneficiaries, claimants and other individuals | Data Principals | Individuals whose personal data is collected and processed by insurers and intermediaries. They are entitled to the rights provided under the DPDP Act, including rights relating to access, correction, grievance redressal, and withdrawal of consent where applicable.
|
Understanding where the the two frameworks intersect
Although developed for different purposes, the two frameworks can apply to the same processing activity. They also reinforce each other in several important areas.
The practical question is therefore not which framework applies, but how the requirements of each framework should be understood alongside one another.
Governance and accountability
The DPDP Act places accountability on Data Fiduciaries to ensure lawful processing of personal data, under Section 8, General obligations of Data Fiduciary. While IRDAI’s framework expects insurers to establishrobust governance mechanisms, maintain effective internal controls, and protect customer information throughout the insurance lifecycle.
Both frameworks therefore impose governance and accountability expectations, but they do so from different regulatory perspectives. DPDP focuses on accountability for personal data processing; IRDAI places those responsibilities within the broader governance, risk and regulatory structure of an insurance company.
Customer-centric data protection
Both frameworks place the customer at the centre of data protection and governance.
While the DPDP Act grants Data Principals statutory rights over their personal data, IRDAI regulations emphasise fair treatment of policyholders, confidentiality of customer information, and transparent business practices.
These requirements may address the same customer interaction without being identical in scope or legal basis. An insurer therefore needs to understand which rights and protections arise from DPDP and which obligations arise from its sector-specific IRDAI responsibilities.
Security and risk management
The DPDP Act requires organisations to implement appropriate technical and organisational safeguards to protect personal data (Section 8(5)). IRDAI similarly expects insurers to maintain robust information security, cyber resilience, and operational risk management frameworks to safeguard sensitive customer information and ensure business continuity.
There is significant potential for existing information security controls to support compliance with both frameworks. However, the fact that a control exists under an IRDAI framework does not necessarily mean that every DPDP requirement has been addressed.
Consent and lawful processing
The DPDP Act establishes a specific framework governing consent and the processing of personal data, including requirements around how consent is obtained and withdrawn where consent is the applicable basis for processing.
For insurers, this sits alongside the consent and lawful processing which were governed under the sectoral principles focused on confidentiality and explicit authorisation under the IRDAI framework instead of a statue protection through the current DPDP Act.
However, consent is only one element of the wider DPDP framework. Insurers therefore need to consider the legal basis for each lawful processing activity rather than treating consent as a blanket requirement for all insurance-related processing.
This becomes particularly relevant as insurers expand their use of digital channels, mobile applications and AI-enabled services.
Personal data breach and incident notification
Personal data breaches provide another clear example of the intersection between the two frameworks.
The DPDP Act creates obligations relating to notification of personal data breaches to the Data Protection Board of India and affected Data Principals. IRDAI’s Cyber Security Guidelines separately establish requirements for reporting qualifying cyber incidents to the regulator.
A single incident may therefore engage obligations under both regimes, but the operational implications of coordinating the different requirements are distinct from the question of how the two frameworks fit together. The practical approach to dual-track incident response is examined in our first article.
Third-Party processing
Insurance operations rely heavily on third parties such as TPAs, brokers, surveyors, cloud providers, and technology vendors.
Under the DPDP Act, the distinction between Data Fiduciary and Data Processor is central to understanding responsibility for processing carried out by another organisation. A Data Fiduciary remains responsible for ensuring that processing undertaken on its behalf is appropriately governed.
IRDAI, meanwhile, imposes its own expectations around outsourcing, information security and oversight of third parties.
This makes third-party classification and governance an important point of intersection: an outsourcing relationship that is straightforward from an insurance regulatory perspective may still require a separate assessment of the parties’ roles under DPDP.
Grievance redressal
Both frameworks recognise the importance of effective grievance handling, although they operate through different mechanisms.
The DPDP Act requires organisations to establish mechanisms for Data Principals to exercise their rights and raise complaints, while IRDAI mandates policyholder grievance redressal processes to ensure customer concerns are addressed promptly and fairly.
For insurers, this means that privacy-related complaints and wider policyholder complaints may arise through different channels and under different regulatory expectations, even where they concern the same underlying activity.
Where the frameworks remain distinct
For insurers and insurance intermediaries, the DPDP Act and IRDAI regulations should not be viewed as competing frameworks. They address different aspects of the same operating environment: the DPDP Act establishes the broader rules governing personal data processing across sectors, while IRDAI’s framework applies those principles within the specific regulatory and operational context of insurance – defining howinsurance entities should operate within the sector.
Understanding the distinction is important because the same activity, from underwriting and claims handling to outsourcing and customer servicing, may be subject to obligations arising from both frameworks.
What this means for insurers and insurance intermediaries
The next step is therefore not simply to identify whether an organisation complies with DPDP or IRDAI requirements in isolation, but to map where the two frameworks overlap, where they impose distinct requirements, and where existing controls can be relied upon or need to be strengthened.
For each significant activity, organisations should identify:
- What personal data is being processed?
- Who determines the purpose and means of processing?
- Which party or parties are acting as Data Fiduciaries or Data Processors?
- Which DPDP obligations apply?
- Which IRDAI requirements apply?
- Which existing controls address requirements under both frameworks?
- Where are there gaps or requirements that need separate treatment?
This approach helps distinguish genuine duplication from complementary obligations and makes it easier to determine where existing governance, security and operational controls can be leveraged.
It also provides the foundation for the practical gap analysis discussed in our first article, which considers what insurers need to do in areas including data governance, incident response, reinsurance data flows and Significant Data Fiduciary readiness.
How HewardMills can help
Navigating the intersection of the DPDP Act and IRDAI requires more than meeting individual regulatory obligations, it calls for a cohesive governance framework that integrates privacy, cybersecurity, risk management, and operational compliance.
A clear understanding of the respective roles and requirements under each framework is an important starting point. From there, insurers and insurance intermediaries can assess how their existing governance arrangements map across the two regimes and where additional controls or accountability may be required.
The DPO’s role can also extend to third-party and cross-border data processing, helping insurers assess how personal data is shared By bringing these considerations into the wider governance framework, the DPO can help insurers move from managing individual compliance obligations to establishing a more consistent approach to data protection.
HewardMills supports insurers and insurance intermediaries in building practical, sustainable compliance programmes that align with both the DPDP Act and sector-specific IRDAI requirements.
If you would like to find out more, contact us today .
