INDIA Law and Practice Contributed by: Neeraj Tuli, Rajat Taimni, Amrit Singh and Anuj Bahukhandi, Tuli & Co
Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules). Insurance-sector regulations also require policy and claim records relating to Indian business to be maintained in data centres in India. Increasingly, insurers are reviewing data flows, notice and consent mechanisms where applicable, and ven- dor arrangements, access controls, retention practic- es and breach-response obligations. These develop- ments may also affect future risks and the nature of privacy and cyber-related insurance disputes. 8.2 Impact of ESG on Underwriting and Insurance Litigation ESG considerations were not mandatory historically. The principal requirement was for certain insurers meeting specified thresholds in terms of turnover, net worth or profit to constitute a Corporate Social Responsibility (CSR) Committee and undertake mini- mum such social expenditure per the Companies Act 2013. However, the IRDAI introduced the IRDAI (Cor- porate Governance for Insurers) Regulations 2024 (CG Regulations), which require all insurers (includ- ing Foreign Reinsurance Branches and Lloyd’s India) to maintain a Board-approved Environmental, Social and Governance framework. ESG activities must be monitored by the Board and the framework reviewed annually. The regulations separately require the Board to estab- lish a comprehensive Climate Risk Management framework, taking into account the size, nature and complexity of the insurer’s operations. The immediate regulatory impact is that insurers are now expected to be able to demonstrate an appropriate framework, oversight and consideration of climate-related risks. 8.3 Data Protection Laws Broadly, India’s data protection regime is governed by the DPDP Act and the recently notified DPDP Rules. The DPDP Act establishes India’s first comprehensive framework governing the processing of personal data. Their commencement is phased: certain provisions are already in force, while most of the principal sub- stantive processing obligations are scheduled to take effect in May 2027.
In addition, insurers and insurance intermediaries are also subject to sector-specific data requirements, including under the IRDAI (Protection of Policyhold- ers’ Interests, Operations and Allied Matters of Insur- ers) Regulations, 2024 (PPHI Regulations), the IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regu- lations, 2025, and the IRDAI Information and Cyber Security Guidelines of April 2026, which require insur- ers and insurance intermediaries to maintain the con- fidentiality and security of data. The practical effect is particularly significant for underwriting and claims handling, both of which commonly involve personal data being exchanged with intermediaries, TPAs, surveyors, investigators, service providers and other participants. In terms of underwriting and claims, India’s cyber- insurance market has experienced steady growth and increasing diversity in product offerings. Product design was initially limited to commercial wordings, and retail wordings being influenced by the erstwhile IRDAI Circular on “Product Structure for Cyber Insur- ance” of 8 September 2021, which set out model cov- erage clauses and exclusions for retail products. Considering that the Indian data protection framework is in a nascent stage, there do not appear to have been any significant disputes of note concerning data protection in the insurance industry at the time of writ- ing. 8.4 Data Centres The growth of data centres and related digital infra- structure is increasing risk exposures to traditional perils such as fire, with high values at risk because of the concentration of high-value equipment. This has recently received some attention through gov- ernment-led reviews of fire safety at data centres. In addition to the traditional perils, the business-critical nature of these facilities also heightens exposures from machinery breakdown, power outages, cooling- system failures and the resulting business interruption and downtime. There is also a significant possibility of liability exposures where outages or service inter- ruptions affect customers or other third parties. From an underwriting perspective, insurers are increas- ingly trying to understand the design, redundancy,
161 I NSURANCE L I T IGATI O N 2026
CHAMBERS.COM
Powered by FlippingBook