DPDP for insurers and insurance brokers

A insurer or broker that keeps personal data in digital form is covered by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (s.3). Typical work: Proposals, underwriting, policies, claims with health and income details.

Where personal data sits

Proposal forms and agent apps
Claims desk
Policy administration system

What Fohrkast maps

Policyholder and insured names
Mobile number
Email address
Address
Date of birth
KYC ID numbers
Health details in proposals and claims
Income details
Details of insured children
Bank details for premiums and claims
Staff names, phone numbers and salary records

Each use of the data is recorded as a purpose:

Proposal and policy. Assess the proposal, issue the policy and collect premiums.
Claims. Assess and settle claims.
Renewal offers. Send renewal reminders and offers for other policies.

Which duties weigh most

Children's data. A child is anyone under 18 (s.2(f)). Before using a child's personal data, a parent's verified consent is needed (s.9(1), Rule 10). Penalty up to ₹200 crore (s.33, Schedule item 3).
Decisions and sharing. Data used to make a decision about a person, or shared with another Data Fiduciary, must be complete, accurate and consistent (s.8(3)).
Security safeguards. Encryption or masking, control over who opens the systems that hold personal data, access logs, backups, and logs kept for one year (s.8(5), Rule 6(1)). Penalty up to ₹250 crore (s.33, Schedule item 1).
Breaches. Every personal data breach, with no size threshold: each affected person and the Board told without delay, and the detailed report to the Board within 72 hours (Rule 7). Penalty up to ₹200 crore (s.33, Schedule item 2).
Requests. A person can ask to see a summary of the data held (s.11), have it corrected or erased (s.12), raise a grievance (s.13) or name a nominee (s.14).
Vendors. A vendor that handles personal data for the business needs a valid contract with reasonable security safeguards; the business stays responsible (s.8(1), s.8(2)).

Sector rules

The sector regulator's rules for a insurer or broker: not set.

A short case

Case: not set. Figures: not set. Customers: not set.

When do the duties start?

Date	What starts	Gazette reference
13 Nov 2026	Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4).	G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3)
13 May 2027	Nearly every duty on businesses, and the Board's penalties.	G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4)

Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early to be safe, and shows each duty as a recommended step until its start date.

Privacy Check: a look at the website's notices, trackers and forms.
Plans and prices in INR.
Book a demo.

Not legal advice.