Is this a consulting service?

No, this is a free, interactive software tool that calculates your potential liability under the DPDP Act 2023 in 30 seconds. It provides an instant risk score and automated action plan.

What are common DPDP violations in InsurTech Platforms?

Common violations include: Collecting detailed medical history and diagnostics on proposal forms without clearly defining its use beyond underwriting, leading to indefinite storage., Sharing policyholder's health data or claim history with re-insurers or marketing affiliates without obtaining explicit, granular consent for each specific purpose., Storing nominee details (name, age, relationship, contact) as part of the policy record without ensuring the policyholder has obtained the nominee's consent or informing the nominee of their data being processed..

The DPDP Audit Tool

Compliance for InsurTech Platforms

🛡️

InsurTech Platforms
Liability Check

InsurTech platforms handling sensitive medical data, claim histories, and nominee details face enhanced DPDP obligations due to the highly personal nature of their data processing.

Why InsurTech Platforms is at Risk

InsurTech platforms are data-rich environments, processing highly sensitive information like **medical records**, **health statuses**, and **nominee data**. Under DPDP, the explicit consent requirements for such data are stringent. Sharing this information with third-party underwriters, healthcare providers, or re-insurers without proper consent mechanisms can lead to significant liabilities. The DPDP Act views this data with heightened scrutiny, demanding robust security measures and clear data processing agreements, especially given the potential for **personal harm** if breached.

Common Violations

1.Collecting detailed medical history and diagnostics on proposal forms without clearly defining its use beyond underwriting, leading to indefinite storage.
2.Sharing policyholder's health data or claim history with re-insurers or marketing affiliates without obtaining explicit, granular consent for each specific purpose.
3.Storing nominee details (name, age, relationship, contact) as part of the policy record without ensuring the policyholder has obtained the nominee's consent or informing the nominee of their data being processed.

The Immediate Fix

Immediately audit all data collection points, especially proposal forms. Ensure explicit, granular consent is obtained for each data category (e.g., medical, nominee) and for every purpose it will be used. Implement a strict data retention policy for medical and claims data, purging it once its purpose is fulfilled, in line with your regulatory obligations.