Consider a cashless hospitalization. The patient’s record might go from the hospital to the third party, through to the insurer’s claims engine and possibly onto an investigation team. A discharge summary becomes a PDF, becomes an attachment, becomes a scanned image and becomes an entry in the claims system. Some of those copies are going to be retained for audit or for dispute purposes. Others remain because nobody owns their disposal. By the time the claim closes, the same personal data may exist in eight or nine places across four or five organisations, with no single owner of the full picture.
This is the very real operational issue that the Indian Digital Personal Data Protection (DPDP) framework is going to force the insurance industry to confront. The Indian insurance market is huge in terms of both the number of policies and the number of people covered. It is a massive generator of personal data (identity data, financial data, health data, nominee data, etc.) and that data flows through a very complex ecosystem of insurers, brokers, third-party administrators (TPAs), reinsurers, hospitals and cloud providers.
With the principal obligations of the DPDP Act set to come into force in May 2027, the gap between what an insurer says it does with personal data and what it actually does is going to be a very real operational risk. It’s not some theoretical compliance issue. If you don’t have in place reasonable security safeguards to prevent a breach of personal data, you can be hit with a penalty of up to ₹250 crore.
Discovery Has to Come Before Governance
Every insurer knows its core policy administration system. That is not the same as knowing its personal data estate. Medical reports in the claims attachments, identity documents in an agent’s onboarding folder, nominee details on the old policy forms, the call recordings, the spreadsheets shared out with the distribution partners, the data in the decommissioned applications- these are all normal insurance business. That’s precisely where the unclassified, ungoverned personal data gets accumulated.
A 2026 survey of Indian companies found that just 38% of them had classified their personal data or identified their third-party processors. In an industry as data-heavy as insurance, that’s just an exposure. CIOs need to be able to discover personal data across both their structured databases and their unstructured repositories and then be able to map that data to its business purpose, system owner, retention requirement, and downstream recipients. Discovery is not a one-off scan. If your inventory can’t show you how the data flows change as a result of a new TPA being onboarded, then it’s just a snapshot and not a true governance capability.
Follow the Policyholder, Not the Application
Customer journeys cut across underwriting, servicing, renewals and claims. Governance is generally structured around systems, vendors and departments. That mismatch is where accountability breaks.
A policyholder who updates contact details or asks what information is held about them may trigger a change in the CRM that leaves outdated records in an agent portal, an analytics platform, and a servicing vendor’s systems. A response that looks complete to one team may be incomplete for the individual. Under DPDP, that individual is a data principal with enforceable rights, and the accountability for honoring them does not dissolve as data moves downstream.
Technology, operations, legal, and business teams must map three journeys together as a starting point: new policy issuance, cashless claims, and renewal. For each of those journeys, they need to work out who gets the data, why they get it, where it’s copied, how correction and deletion requests get to all the relevant systems, and who is ultimately responsible for the answer if something goes wrong.
Third-Party Accountability Cannot Just Be Contractual
Insurance is an ecosystem business. Brokers, corporate agents, hospitals, TPAs, reinsurers, cloud providers, and the Insurance Information Bureau all participate in the value chain. A signed data processing agreement does not constitute control. Insurers need an operational view of which partners have which categories of personal data, what those data can be used for, any arrangements for onward sharing, and how access is removed when the relationship ends.
Nearly 30% of the breaches involved a third party (that’s double the prior year). In the insurance world where a TPA may be holding the medical data of thousands of policyholders at any one time, third-party exposure is a first-order risk rather than a secondary one.
Even as insurers work together to establish common approaches to data governance, each organisation’s data environment extends beyond the industry itself. Technology platforms, hospitals, TPAs, cloud providers and other external partners all shape how personal data is collected, shared and used. Industry-wide standards provide an important foundation, while effective implementation depends on understanding how these principles apply across the wider data ecosystem. This is where practical experience in translating DPDP requirements into working enterprise capabilities becomes valuable, an approach that also informed Privy by IDfy’s recognition as the winner of the MeitY–NeGD DPDP Innovation Challenge.
Incident escalation also needs to be rehearsed. A partner who detects suspicious access should know who to contact, how quickly to contact them and what evidence to preserve. Under DPDP, an insurer will remain liable for personal data processed on its behalf regardless of the contractual arrangements that exist.
AI and Retention Require the Same Discipline
Insurers are increasingly using AI for fraud detection, underwriting and customer service. Before using historical claims data to develop or refine a model, leaders need to establish where the data came from, whether the intended use is within the original purpose for which the data was collected, and which attributes are actually required.
Purpose limitation under DPDP is not a drafting exercise. It is an architectural constraint. Retention works on the same basis. Insurers aren’t in a position to simply delete all records on request. There will be legal and regulatory retention requirements in place in many cases, and there will be specific circumstances (e.g., an ongoing dispute, an active fraud investigation) which will also require records to be retained. Each retention decision will need to be based on some documented rationale.
The Board-Level Question
The metric isn’t the number of privacy policies that have been updated. It’s how quickly an insurer can find an individual’s information, determine its purpose and who it was shared with, satisfy the appropriate request, and be able to justify why certain records were kept.
For the CIO, the opportunity is to take the disparate compliance activities and turn them into an enterprise capability; continuously discovering the data, understanding the context of that data, and governing the use of that data. Insurance is about being there for people when they are at their most vulnerable. In a digital world, being able to account for the data of those people is part of keeping that promise.
