The Insurance Regulatory and Development Authority of India (IRDAI) has set up a task force to study the impact of the Digital Personal Data Protection Act, 2023, on the insurance sector. The said task force is expected to submit its report within one month.
Notified in August 2023, the DPDP Act applies to the processing of digital personal data and imposes several obligations on data fiduciaries. For instance, a data principal’s personal data can be processed only in accordance with the Act’s provisions and for a lawful purpose for which consent has been obtained from the data principal. Such processing must be for certain legitimate uses. Further, the Act envisages the setting up of the Data Protection Board of India to ensure due compliance with its provisions. Any breach in observing the obligations imposed under the Act will attract hefty penalties. However, the provisions of the Act have not been brought into force yet.
When it comes to the insurance sector, there is a large amount of personal data that is handled by data fiduciaries (who determine the purpose and means of processing of personal data) and data processors (who process personal data on behalf of a data fiduciary). Consequently, the DPDP Act bears great significance for the sector and an attempt is being made to gauge its implications by setting up of the task force.
As per IRDAI’s order dated November 24, 2023, the eleven-member task force comprises officials from the regulatory body and heads of leading insurance companies along with an expert from the legal field.