InsurTech Platforms
Liability Check
InsurTech platforms handling sensitive medical data, claim histories, and nominee details face enhanced DPDP obligations due to the highly personal nature of their data processing.
Why InsurTech Platforms is at Risk
InsurTech platforms are data-rich environments, processing highly sensitive information like **medical records**, **health statuses**, and **nominee data**. Under DPDP, the explicit consent requirements for such data are stringent. Sharing this information with third-party underwriters, healthcare providers, or re-insurers without proper consent mechanisms can lead to significant liabilities. The DPDP Act views this data with heightened scrutiny, demanding robust security measures and clear data processing agreements, especially given the potential for **personal harm** if breached.
Common Violations
- 1.Collecting detailed medical history and diagnostics on proposal forms without clearly defining its use beyond underwriting, leading to indefinite storage.
- 2.Sharing policyholder's health data or claim history with re-insurers or marketing affiliates without obtaining explicit, granular consent for each specific purpose.
- 3.Storing nominee details (name, age, relationship, contact) as part of the policy record without ensuring the policyholder has obtained the nominee's consent or informing the nominee of their data being processed.
The Immediate Fix
Immediately audit all data collection points, especially proposal forms. Ensure explicit, granular consent is obtained for each data category (e.g., medical, nominee) and for every purpose it will be used. Implement a strict data retention policy for medical and claims data, purging it once its purpose is fulfilled, in line with your regulatory obligations.
Get DPDP Updates for InsurTech Platforms
We'll send you compliance alerts and deadline reminders specific to your area. No spam — unsubscribe anytime.
Projected Compliance Deadline: Immediate
Next step after the audit
The audit shows the gaps. Sanctum closes them. One programme covers legal position, data map, gap analysis, implementation, tooling, training, a written readiness opinion, and breach cover, under one accountable owner. See the all-in-one programme
What Should You Do Next?