Data Is The New Risk: How The DPDP Rules Impact The Insurance Sector

Introduction

India's current data protection regime is governed by the Information Technology Act 2000 ("IT Act"), read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules") issued under Section 43A of the IT Act. Section 43A of the IT Act and the SPDI Rules will, however, stand repealed once the Digital Personal Data Protection Act 2023 ("DPDP Act") and the recently notified Digital Personal Data Protection Rules 2025 ("DPDP Rules") are fully operational. The DPDP Act establishes a comprehensive framework governing the processing of personal data in India.

The Government of India has adopted a phased implementation approach through notifications under the DPDP Act. Based on notifications issued as of date, the framework is expected to be operationalised in stages, with early provisions relating to the constitution of the Data Protection Board of India coming