Do insurers need consent to process health data for a claim?

Processing needed to settle a claim the policyholder has filed is generally tied to that request, but using the same data for other purposes, such as analytics or marketing, needs a separate basis. Insurers should record the purpose for each use.

Who is responsible for consent collected by agents or banks?

The insurer remains responsible for the purposes it decides, even when an agent, broker or bank collects the data. It should be able to show what the policyholder agreed to. SecureCMS records OTP-verified consent on partner journeys against the policyholder record.

Are TPAs data processors under the DPDP Act?

Where a TPA processes policyholder data on the insurer's instructions to handle claims, it generally acts as a Data Processor and the insurer as the Data Fiduciary. The insurer must make sure the TPA uses data only for that purpose.

Can a policyholder ask an insurer to delete data after a policy lapses?

Yes, but the insurer can keep records that a law requires it to retain. The rest must be erased. SecureCMS logs which fields are kept, the legal reason and the release date.

How should insurers handle telematics and wearable data?

Telematics and wearable data is collected continuously, so it should sit under its own consent that the policyholder can withdraw at any time. SecureCMS stops downstream use as soon as consent is withdrawn and checks consent before each use.

Is SecureCMS a registered Consent Manager?

SecureCMS is a consent management platform that insurers use as Data Fiduciaries. Registered Consent Managers are separate entities registered with the Data Protection Board from 13 November 2026.

When do DPDP obligations apply to insurance companies?

The DPDP Rules were notified on 13 November 2025. Consent Manager provisions apply from 13 November 2026, and the remaining obligations, including notice, consent, rights and breach reporting, apply from 13 May 2027.

LIVE

Core DPDP Enforcement:13 May 2027

207D

11H

45M

00S

DPDP Act 2023 & IRDAI Cyber Security HarmonizedLife · Health · Motor · General · TPAs

Consent Management for Insurance Companies

SecureCMS records and enforces policyholder consent from proposal to claim, across agents, bancassurance partners, digital channels and TPAs. Built strictly for the DPDP Act 2023 and DPDP Rules 2025.

Regulatory Quick-Answer: Blanket Proposal Declarations Are Void

Traditional "I agree to all terms" blanket checkboxes are legally invalid under Section 6. Insurers must unbundle underwriting declarations from commercial cross-sell, motor telematics, and third-party data sharing with TPAs.

Insurance Compliance Architecture

Point-of-Sale Burden of Proof

Section 6(10) OTP Proof

Direct Policyholder Verification

TPA Claims Limiting

Field-Level Medical Masking

Section 8(2) Processor Bound

Continuous Telematics

Sub-100ms Revocation Sync

Instant IoT Stream Termination

Incubated & Evaluated By

DSCI Certified Member

CySecK Evaluated

IFSCA FinTech Cohort

IIT Kanpur C3iHub

Policyholder Lifecycle

Consent Mapping Across the Insurance Lifecycle

From proposal submission to claim settlement and policy lapse, here is how statutory data rights are enforced.

Policy Stage	Activity & Touchpoint	DPDP Legal Basis	Consent Rule
Proposal & Quotation Stage	Capturing personal, medical, and lifestyle data for underwriting	Section 7(a) Voluntary proposal provision + Section 6	Unbundled opt-in for underwriting; separate opt-ins for cross-sell.
Policy Issuance & Active Servicing	Premium debit, endorsements, address changes, notices	Contractual execution & Section 7 legitimate use	No separate popup for premium receipts or policy renewals.
Cashless Claim / TPA Adjudication	Sharing medical records with Third Party Administrator (TPA)	Section 8(2) Data Processor Agreement + Requested Claim	Restricted strictly to claim adjudication; unrelated history masked.
Telematics & Driving Behavior (Motor)	GPS acceleration, speed, trip logging for dynamic pricing	Section 6(1) Explicit Ongoing Consent	Continuous stream with instant in-app revocation toggle.
Juvenile Policy (Child Life/Health)	Processing child PII under 18 years of age	Section 9 Verifiable Parental Consent	Mandatory guardian OTP; zero profiling or targeted advertising.
Lapsed Policy / DSR Erasure Request	Policyholder requests complete data purge post lapse	Section 12 Erasure vs IRDAI / PMLA Legal Hold	Marketing purged; claim ledgers locked for 5 years under law.

Real-Time Sandbox

Simulate Proposal POS, TPA Limiting & Telematics Opt-Outs

Toggle unbundled proposal options, observe TPA cashless claim field-redaction, and test real-time IoT motor telematics stream revocation.

Interactive Simulator

Insurance Proposal POS Consent & TPA Redaction Sandbox

Simulate unbundled POS proposal flows, TPA cashless claim field-limiting, telematics opt-outs, and IRDAI legal holds.

Agent POS Tablet / Branch Portal

Proposal #POL-2026-8921

Underwriting & Policy Issuance

Medical history declaration, age verification, premium calculation.

Section 7(a) Application

Policy Application Basis Essential Terms

Cross-Sell Group Health & Annuities

Share demographic data for partner investment and health plans.

Section 6 Unbundled ChoiceStrictly Opted Out

Pay-How-You-Drive Motor Telematics

GPS acceleration, speed logging for safe driver premium discounts.

Continuous IoT TelemetryTelematics Active

Section 6(10) Burden of Proof Defense Engine

Even when a field agent or bancassurance bank executive fills out the proposal form on their tablet, SecureCMS dispatches an instantaneous OTP directly to the policyholder's registered mobile number, generating an unassailable evidentiary record.

Policyholder OTP:Verified (+91 98201 4****)

Notice Language:Bengali + English (Sec 5(3))

Cryptographic Receipt:sha256:1a8b...449c (Signed)

Core PAS Sync:Guidewire PolicyCenter (28ms)

Platform Architecture

Enterprise Insurance Consent Modules

Modular components built specifically for life insurers, general underwriters, health SAHIs, and InsurTech platforms.

POSP / Agent Ready

Omnichannel Proposal Consent Station

Captures unbundled OTP-verified consent at the point of sale across individual agents, POSPs, bancassurance bank counters, and online portals.

TPA Minimization

TPA & Surveyor Field-Level Redactor

Controls downstream data transmission to Third Party Administrators. Exposes only hospital bills and diagnosis codes, masking unrelated medical notes.

IoT / Telematics

Telematics & Wearables Consent Pipeline

Real-time consent gateway for pay-how-you-drive motor sensors and health wearables, with sub-100ms suppression webhooks upon withdrawal.

Child Policy Guard

Section 9 Juvenile Policy Safe-Harbor

Verifies parental/guardian identity for child policies while automatically applying firewall rules to block behavioral profiling and marketing outreach.

IRDAI / PMLA Vault

IRDAI & PMLA Statutory Legal-Hold Engine

Enforces 5-year post-settlement or post-lapse retention rules to protect the insurer during fraud investigations and regulatory audits.

Guidewire / Duck Creek

Core Policy Admin Connectors

Turnkey API and message bus connectors for Guidewire, Duck Creek, SAP for Insurance, and custom Core Policy Administration Systems.

Distribution Channel Governance

Section 6(10) Burden of Proof Across Agents & Bancassurance

Under the DPDP Act, the insurer bears the absolute legal burden to prove that consent was lawfully obtained—even when collected offsite by an independent insurance agent, broker, or bancassurance branch manager.

Direct Policyholder Mobile OTP: Proposal forms triggered on agent tablets require direct OTP confirmation from the policyholder's own mobile number.

Cryptographic Evidentiary Hashes: Every consent transaction is hashed using SHA-256 and signed with asymmetric key pairs to produce court-admissible audit receipts.

TPA Claims Minimization: Automatic redaction ensures TPAs only receive medical claims invoices and ICD codes, masking unrelated financial or family notes.

Core Policy Admin & Claims Integrations

Guidewire PolicyCenter & ClaimCenter

Pre-built connectors to sync consent flags directly into policyholder master records and claims workflows.

Duck Creek Technologies Connector

Bi-directional REST API integration for real-time unbundled consent validation at quotation and binding.

IRDAI & PMLA Statutory Legal-Hold Vault

Maintains mandatory 5-year retention holds on settled claims, KYC files, and premium ledgers upon policy lapse.

Statutory Timeline

6-Phase Insurance Implementation Roadmap

Structured deployment path to achieve complete compliance before the mandatory 13 May 2027 statutory deadline.

Weeks 1–2Step 01

Phase 1: Distribution Channel & Proposal Audit

Eliminate blanket proposal clauses across agency, bancassurance, broker, and aggregator portals.

Weeks 3–4Step 02

Phase 2: Point-of-Sale OTP Consent Deployment

Deploy direct policyholder mobile OTP verification across agent tablet apps and branch terminals.

Weeks 5–6Step 03

Phase 3: Core PAS & Claims Engine Sync

Integrate with Guidewire / Duck Creek / SAP to synchronize consent records with policy master files.

Weeks 7–8Step 04

Phase 4: TPA & Reinsurer Field-Level Redaction

Configure field-level access filters for external TPAs, motor loss surveyors, and reinsurers.

Weeks 9–10Step 05

Phase 5: Telematics & DSR Legal-Hold Setup

Enable in-app preference center for telematics; lock 5-year IRDAI retention schedules for lapsed policies.

Weeks 11–12Step 06

Phase 6: IRDAI Cyber Security & DPDP Go-Live

CERT-In empaneled VAPT sign-off, board audit committee presentation ahead of 13 May 2027.

Related DPDP Compliance Modules

DPDP Platform for Healthcare & Hospitals

Clinical emergency overrides, OPD/IPD intake, and hospital HIS integration.

DPDP Platform for Banks

Core banking system connectors, CBS integration, and RBI guidelines.

SecureCookie CookieHub

Cookie consent and banner automation for insurance portals and aggregators.

DPDP Readiness Assessment

Diagnostic toolkit and gap analysis for Indian insurers and TPAs.

Official Statutory Sources

Digital Personal Data Protection Act 2023 (Official Gazette)IRDAI (Information and Cyber Security) Guidelines Insurance Regulatory and Development Authority Act 1999 Prevention of Money Laundering (Maintenance of Records) Rules

Legal & Operational Clarity

Frequently Asked Questions for Insurance Leadership

It is how an insurer records, verifies and enforces each policyholder's consent for every purpose, from proposal to claim, across agents, bank partners and digital channels. A consent management platform does this in software, controls data shared with TPAs and partners, and keeps evidence for DPDP reviews.

Book a Meeting