DPDP for insurers, brokers and intermediaries

Insurance is a promise priced on personal data. To issue a policy you collect identity, income, family details, lifestyle habits and, for life and health cover, medical history and test results. To settle a claim you collect hospital bills, discharge summaries, accident reports and bank details. That data then travels to agents, brokers, TPAs, hospitals, investigators, reinsurers and regulators, often across many years and sometimes across borders.

The risk sits in two places. Health data is spread across a long chain of partners, each of which can leak or misuse it. And selling is driven by leads bought from aggregators, call centres and data brokers, many of which cannot show any consent. This guide applies the Data Fiduciary playbook to insurers and insurance intermediaries.

Are you a Data Fiduciary, a processor, or both?

• Insurer: you are the Data Fiduciary for proposers, policyholders, insured members, nominees, beneficiaries and claimants. Your policy administration vendor, cloud host, medical examination centres you engage, call centres and messaging providers are your Data Processors.
• TPA: for health claims you act for the insurer, so you are usually its processor. You are a fiduciary for any purpose you decide yourself, such as building your own analytics products. IRDAI rules already limit what TPAs may do with policyholder data.
• Broker or web aggregator: you are a Data Fiduciary for the leads and clients you collect. When you pass a proposal to an insurer, that insurer becomes a separate fiduciary. Brokers placing reinsurance or group cover may also act on a client’s instructions.
• Corporate agent (a bank, NBFC or retailer): you are a fiduciary for your own customers. Using your customer base to sell insurance is a new purpose that needs its own ground, usually consent. See banks, NBFCs and lenders.
• Individual agents and POSPs: they collect data for the insurer or intermediary they represent and act as its processors. You are responsible for what they do on your behalf (section 8(1)).
• Reinsurers: separate fiduciaries for the data you cede to them, usually only what is needed for large or complex risks and claims.
• Hospitals and diagnostic centres: separate fiduciaries for their patients. They share data with you for cashless claims at the patient’s request. See healthcare, diagnostics and pharmacy.
• Employers buying group cover: the employer is a fiduciary for its employees and shares data with you to enrol them. You are a fiduciary for the insured members. See employers and HR.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Identity and KYC (name, PAN, masked Aadhaar, photo, address)	Policy admin system, KYC vendor	Proposal, KYC, PMLA	High	As KYC, PMLA and IRDAI rules require
Proposal form answers (income, occupation, habits, family)	Proposal system, agent apps, paper forms	Underwriting	High	Policy life plus legal minimums
Medical history, test results, medical examiner reports	Underwriting system, diagnostic centres, email	Underwriting	Very high	Policy life plus legal minimums; strict access
Claims documents (bills, discharge summaries, FIRs, death certificates)	Claims system, TPA platform, hospitals	Claim settlement	Very high	Until the claim and any dispute close, plus legal minimums
Hospital and pre-authorisation data	TPA platform, hospital portals, health claims exchanges	Cashless claims	Very high	Claim life plus legal minimums
Bank details for premiums and claim payouts	Payments system, mandates	Premium collection, payouts	High	Policy life plus legal minimums
Nominee, beneficiary and legal heir details	Policy admin system	Nomination, claims	Medium to high	Policy life and until claim settlement
Group policy member lists (employees, dependants)	Employer HR exports, group admin portal	Enrolment, claims	High	Policy term plus legal minimums
Vehicle, property and travel details	Policy admin, surveyor reports	Motor, property and travel cover	Medium	Policy life plus legal minimums
Surveyor and investigator reports, photos	Claims system, investigator files	Claims, fraud	High	Until the claim and any dispute close
Leads and quote requests	CRM, aggregator feeds, call centre dialers	Sales	Medium	Short; until the quote purpose ends or consent is withdrawn
Call recordings and sales verification calls	Telephony vendor, quality tools	Sales verification, mis-selling checks	Medium to high	As IRDAI and dispute needs require
Wellness and wearable data	Wellness apps, partner platforms	Rewards, wellness programmes	High	Short; until consent is withdrawn
Agent and POSP data	Agent portals, licensing system	Licensing, commissions	Medium	Relationship plus legal minimums

Risk hotspots

1. Health data in underwriting. Proposal forms, medical tests and examiner reports reveal conditions a person may not have told their family or employer. Failure: health data shared widely in underwriting queues, email and agent apps. Control: collect only what the product’s underwriting needs, store medical reports in a restricted system, limit access to underwriters and medical officers, and log every access.
2. Claims and the hospital chain. Cashless claims move discharge summaries, diagnoses and bills between hospitals, TPAs and insurers. Failure: claims files on shared drives, hospital portals with weak passwords, documents sent by plain email. Control: exchange through controlled portals or a claims exchange, encryption in transit and at rest, and contracts that cover security and breach notice.
3. TPAs and processors. TPAs, medical examination centres, investigators and call centres all hold policyholder data. Failure: a processor reuses data or leaks it, and you remain responsible (section 8(1)). Control: DPDP clauses in every contract, data minimisation per role, audits, and erasure confirmation at the end of each engagement.
4. Reinsurers and cross-border sharing. Data on large risks and claims goes to reinsurers, some abroad. Failure: full medical files sent abroad where a summary would do, and no record of what went where. Control: share pseudonymised or summary data by default, check rule 15 and any IRDAI requirements before transfers, and record each transfer.
5. Waiver clauses. The Act’s own illustration under section 6(2) is an insurer whose app takes consent to issue the policy and a waiver of the right to complain to the Board. The waiver part is invalid. Failure: legacy declarations that waive rights, limit complaints, or deem consent to everything. Control: a clause-by-clause review of proposal forms, app consent screens and policy wordings.
6. Lead buying and call-centre selling. Leads bought from aggregators, data brokers or “partners” often have no traceable consent. Failure: every sales call to such a lead is processing without a ground, and often a TRAI breach too. Control: buy only leads with a consent record you can verify, check consent before each call, and honour DND and withdrawals.
7. Group insurance through employers. Employers send member lists with employee and dependant data, sometimes including health declarations. Failure: more data than enrolment needs, sent by spreadsheet, and dependants who were never told. Control: a defined enrolment data set, a secure portal for uploads, and a notice to members at enrolment that covers dependants.
8. Nominee data. Policyholders give nominee details without the nominee’s involvement. Failure: nominee contact data used for marketing. Control: use nominee data only for nomination and claims, and give the nominee a notice when you first contact them.
9. Corporate agents and bancassurance. Banks and NBFCs sell insurance to their customers, often at the loan desk. Failure: insurance bundled with loans, and bank data shared with insurers without consent. Control: separate consent at the corporate agent for insurance offers, and no tied selling.
10. Wellness programmes and wearables. Step counts, heart rate and sleep data feed rewards. Failure: using wellness data for underwriting or renewals without consent. Control: separate opt-in consent, clear limits on use, and erasure when the programme ends.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Quote and proposal processing	7(a), where the person asks for a quote or applies	Collect only what the quote or proposal needs.
Underwriting with medical history and tests	Consent, or 7(a) where the proposer voluntarily provides it to get cover	Itemise the medical data and tests in the notice.
KYC and AML checks	Consent, or 7(a) as part of the proposal	Keep what the KYC and PMLA rules require.
Issuing and servicing the policy	7(a)	Service messages only; no promotions without consent.
Claim settlement, including cashless claims	7(a), as the claimant asks for settlement	Share with hospitals and TPAs only what the claim needs.
Life-threatening emergency at a hospital before the claim is formalised	7(f)	Only to the extent the emergency needs.
Sharing with reinsurers	7(a) for the policy purpose, or consent; name reinsurers as a category in the notice	Check rule 15 and IRDAI rules for transfers abroad.
Fraud detection and investigation	17(1)(c)	Do not reuse fraud data for marketing.
Defending or pursuing a claim in court or at the ombudsman	17(1)(a)	Keep files under a legal hold.
Reporting to IRDAI, tax and other authorities	7(d)	Keep a disclosure log. 17(1)(b) covers the regulator’s own processing, not yours.
Retaining policy and claims records	Retention required by law (section 8(7))	Stop all other use of the retained records.
Group policy enrolment	Employer: 7(i). Insurer: 7(a) for data the member provides for the cover; consent for anything more	7(a) needs data the person gave you; for data that reaches you only from the employer, confirm your ground with counsel. The employer and insurer each give notice for their own role.
Nominee data	7(a), as supplied by the policyholder for nomination	Use it only for nomination and claims.
Marketing, renewal offers for other products, cross-sell	Consent, per channel and product line	Also follow TRAI’s TCCCPR.
Calling bought leads	Consent that names you or your category of insurer	No traceable consent, no call.
Wellness and wearable programmes	Consent	Separate from the policy; not a condition of cover.

Notices and consent: getting the screens right

Channel	Do	Don’t
Branch, agent or POSP meeting	Give a printed notice in the customer’s language with the proposal form; record each optional choice separately; sign off on the agent’s app with the customer’s own OTP.	Let the agent fill in health answers and tick boxes for the customer.
App and website	Show the notice before the proposal form; list medical data and tests; put marketing as separate unticked toggles.	Add a clause waiving the right to complain to the Board.
Web aggregator	Name the insurers that will receive the data before the user submits; let the user choose.	Send one form to every partner insurer by default.
Call centre and telesales	Check consent before dialling; read a short notice before recording; confirm the customer’s choice on the call and record it.	Call bought lists or people on DND.
WhatsApp and SMS	Record the opt-in source and time; separate policy alerts from promotions; put “STOP” in every promotion.	Treat a policy-service opt-in as consent to cross-sell.
Paper proposal forms	Put the notice on the first page, keep health declarations on a separate sheet, and scan into a controlled system.	Mail paper forms with medical reports through agents.
Hospital helpdesk and TPA desk	Give a short notice on what will be shared with the insurer and TPA for the claim.	Ask for documents the claim does not need.
Group enrolment portal	Give members a notice at enrolment covering their own and their dependants’ data.	Rely on the employer’s HR policy as your notice.
Existing policyholders	Send a section 5(2) notice with the renewal notice or in-app, with a link to review and change choices.	Assume old declarations cover new purposes.

Each notice must stand on its own, itemise the data and purposes, and give the link and other means to withdraw consent, exercise rights and complain to the Board (rule 3). Customers must be able to read it in English or any of the 22 Eighth Schedule languages (section 5(3)). Rural and semi-urban customers often meet only an agent, so the printed notice in the local language matters as much as the app screen.

Other laws you must line up with

• Insurance Act 1938 and IRDAI regulations on policyholders’ interests, maintenance of records, outsourcing and information and cyber security: these set record-keeping, confidentiality, outsourcing and incident reporting duties. Some IRDAI rules require records to be kept in India. Confirm the current requirement with counsel.
• IRDAI regulations on intermediaries (brokers, corporate agents, web aggregators, insurance marketing firms, POSPs) and on TPAs: they limit how intermediaries and TPAs may use and share policyholder data, and overlap with DPDP processor and purpose duties.
• Insurance Ombudsman Rules 2017 and the IRDAI grievance system: parallel grievance routes. Link them to your DPDP grievance process, but keep them distinct.
• PMLA 2002 and KYC rules: KYC and record-keeping for life insurance and some other products. They override erasure requests for those records only.
• Aadhaar Act 2016: limits on Aadhaar authentication and storage. Use masked Aadhaar, offline verification or DigiLocker where the KYC rules allow.
• Clinical Establishments Act and state health laws, ABDM and health claims exchanges: hospitals’ own duties on medical records, and consent-based health data exchange. Align claim documents with those flows.
• Motor Vehicles Act 1988: third-party motor cover and accident claims involve police and tribunal records.
• IT Act 2000 and CERT-In Directions 2022: short incident reporting timelines and log retention. Confirm the current requirement with counsel.
• TRAI TCCCPR: consent and registration for commercial calls and SMS, which applies to every telesales campaign.
• Consumer Protection Act 2019: mis-selling and unfair contract terms can breach consumer law as well as DPDP.
• Income-tax Act and GST: premium and payout records that override erasure for those records only.

Retention and erasure

1. Section 8(7): erase personal data when consent is withdrawn or the purpose is over, whichever is earlier, unless a law requires you to keep it. A lapsed or matured policy still has records you must keep; it does not need its marketing profile or the wellness data.
2. Rule 8(3) minimum: keep personal data, associated traffic data and processing logs for at least one year from the date of processing, then erase them unless another law needs longer. IRDAI record rules usually do.
3. Declined proposals and quotes: people who were quoted or declined but never bought are a common blind spot. Erase their medical reports and proposal data once the purpose and any legal retention end.
4. Legal holds: disputed claims, ombudsman cases, consumer court matters and fraud investigations put a hold on the relevant files. Record the hold, the reason and a review date.
5. Leads: erase bought and inbound leads that did not convert after a short, documented period, and immediately when consent is withdrawn.
6. The Third Schedule three-year rule applies to large e-commerce, online gaming and social media entities, not to insurers as such. A web aggregator should check whether it counts as an e-commerce entity with 2 crore or more registered users. Confirm the current requirement with counsel.
7. Processors and partners: make TPAs, examination centres, investigators, call centres, brokers and cloud providers erase data you gave them, and get written confirmation (section 8(7)(b)).
8. Backups and paper: document backup retention, protect archives with the same access controls, and keep a destruction log for paper proposal and claims files.

Rights requests and grievances

• Channels: the app, website, branches, the call centre and an email address. Publish them with the identifier you need (rule 14(1)), such as the policy number, proposal number or registered mobile. Rule 14(5) expressly lists an application reference number and a customer acquisition form number as identifiers.
• Identity: verify with an OTP to the registered mobile or email, or against KYC you already hold. Do not ask for new documents you do not already hold.
• Access (section 11): give a summary of the data you process and what you do with it, and list the fiduciaries and processors you shared it with: TPAs, hospitals, reinsurers, brokers, corporate agents, investigators, examination centres.
• Correction (section 12): let customers update contact and nominee details; route corrections to health declarations through underwriting, since they may affect the policy.
• Erasure (section 12(3)): refuse only what you must keep for a running policy, an open claim or by law. Erase the rest and tell the customer what you kept and why.
• Grievances: acknowledge quickly and publish a resolution period inside the 90-day ceiling in rule 14(3); 15–30 days is good practice. Name your DPO or contact person in every reply (rule 9). A customer must use your grievance process before going to the Board (section 13(3)), and no clause can take away the right to go to the Board (section 6(2)).
• Nomination (section 14): DPDP nomination lets someone exercise data rights on the customer’s death or incapacity. It is separate from the policy nomination under insurance law, which decides who receives the claim money. Explain the difference and offer both.
• Children and guardians: for child plans and family floaters, the parent or guardian exercises rights for the child. For persons with disability, check guardianship under rule 11.

Breach readiness

Likely scenarios:

• a TPA or hospital portal exposing claims documents and diagnoses
• a broker or web aggregator database of leads and medical declarations leaked
• an agent’s phone or laptop with proposal forms lost
• a call centre insider selling policy and contact data
• a misconfigured storage bucket of medical reports
• ransomware on the policy administration system

Run-book:

1. Contain within hours: revoke credentials, suspend the partner’s access, take exposed storage offline, and preserve logs.
2. Assess: which data, how many people, and which consequences: exposure of health conditions, fraud, fake claims, phishing, discrimination.
3. Notify affected people without delay through their registered mobile, email or account, covering every point in rule 7(1): what happened, when and how far it went, the consequences for them, what you are doing, what they should do (beware of fake claim or refund calls, never share OTPs), and a contact person. Write health breach notices with care; the person may not have told family about the condition.
4. Notify the Board without delay, then send the detailed report within 72 hours (rule 7(2)).
5. Report to CERT-In and IRDAI under their directions, on their own clocks, and inform the TPA, broker, hospital or reinsurer involved.
6. Learn: fix the root cause, update partner contracts, and retrain agents and staff.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Name the DPO or accountable DPDP owner and a working group across underwriting, claims, distribution, IT, legal, compliance and CX.
• [DPO] Map every collection point: agent and POSP apps, branches, website, app, aggregators, call centres, corporate agents, group enrolment, hospital desks.
• [Eng] Inventory every system holding policyholder data: policy admin, underwriting, claims, TPA platforms, CRM, dialers, data warehouse, email, backups.
• [Underwriting] List every medical data item and test you collect, by product, and why each is needed.
• [Claims] Map how claims documents move between hospitals, TPAs, surveyors, investigators and your teams.
• [Legal] List all processors and partners: TPAs, examination centres, investigators, call centres, brokers, corporate agents, web aggregators, reinsurers, cloud.
• [Legal] Review proposal forms, app consent screens and policy wordings for waiver clauses and blanket consents.
• [Distribution] List every lead source, and whether each can show a consent record.
• [Compliance] Write down every legal retention requirement by record type, with the source.
• [Legal] Find every transfer of policyholder data abroad, including to reinsurers and group companies.
• [Leadership] Assess the likelihood of SDF status and budget for a DPIA and annual audit.

Phase 2: design and build (days 31–90)

• [Legal] Assign a legal basis to each purpose using the table above, and stop purposes without one.
• [Legal] Remove waiver clauses and blanket consents from forms, apps and policy wordings (section 6(2)).
• [Legal] Write itemised notices for quotes, proposals, medical tests, claims, group enrolment, wellness and marketing.
• [Product] Translate notices into the languages of your markets, and make all 22 Eighth Schedule languages available.
• [Underwriting] Cut medical questions and tests to what each product’s underwriting needs.
• [Eng] Move medical reports into a restricted store with access by underwriters and medical officers only, and log every access.
• [Claims] Replace email exchange of claims documents with portals or a claims exchange, encrypted in transit and at rest.
• [Claims] Define the minimum document set per claim type and stop asking for extras.
• [Legal] Add DPDP clauses to TPA, examination centre, investigator, call centre, broker and cloud contracts: purpose limits, security, breach notice, erasure on instruction, one-year logs, sub-processors, audit.
• [Legal] Agree with reinsurers what data they receive, in what form, and where it is stored; default to summaries.
• [Distribution] Stop buying leads without a verifiable consent record; add consent warranties and audit rights to lead contracts.
• [Eng] Check consent and DND status before every outbound call and message.
• [Distribution] Move agent and POSP data collection into your own app with the customer’s OTP sign-off; ban WhatsApp transfers of forms.
• [Distribution] Require corporate agents to collect separate insurance consent and stop tied selling with loans.
• [Ops] Define the group enrolment data set and a secure upload portal for employers.
• [Product] Give insured members and dependants a notice at group enrolment.
• [Product] Put wellness and wearable data behind a separate opt-in, and keep it out of underwriting unless the person agrees.
• [Eng] Move to DigiLocker, offline e-KYC or masked Aadhaar where the KYC rules allow.
• [Security] Add MFA and IP restrictions to TPA, hospital, broker and agent portals; alert on bulk downloads.
• [Eng] Keep access and processing logs for at least one year, and longer where IRDAI or CERT-In rules say so.
• [Eng] Build retention jobs per record type, including declined proposals, unconverted leads and closed claims, with legal holds.
• [Product] Publish the privacy page: DPO or contact person, rights channels, identifier (policy or proposal number), grievance timeline.
• [CX] Set up the rights and grievance workflow with verification, owners and deadlines, linked to the IRDAI grievance desk.
• [Product] Offer DPDP nomination and explain how it differs from policy nomination.
• [Product] Send the section 5(2) notice to existing policyholders with renewals or in-app.
• [Security] Write the breach run-book covering the Board, CERT-In and IRDAI, with sensitive wording for health breaches.

Phase 3: operate (ongoing)

• [DPO] Review new products, partners, lead sources and campaigns before launch.
• [Compliance] Audit a sample of TPAs, brokers, corporate agents and call centres every quarter for data handling.
• [Distribution] Sample sales call recordings every month for consent, DND and mis-selling.
• [Claims] Review claims document requests every quarter for data the claim did not need.
• [Security] Run a penetration test every year on apps, portals and APIs.
• [Security] Run a breach drill every year (for example, a TPA portal leak) against the 72-hour clock.
• [CX] Review rights and grievance timelines every month and investigate overdue cases.
• [Legal] Review partner contracts, lead contracts and reinsurance data terms every quarter.
• [DPO] Keep evidence: notices, consent records, withdrawal handling, erasure confirmations, training records.
• [HR] Train agents, POSPs, underwriters, claims staff and call centre staff every year, with tests.
• [DPO] If notified as an SDF, run the DPIA and audit every 12 months and send the report of significant observations to the Board (rule 13).

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Ask consent per purpose for marketing, cross-sell and wellness	Define purposes once, each tagged consent or legitimate use, with sensitivity and retention. The hosted consent page (popup, redirect or QR code), widget or SDKs show each as a separate toggle, off by default.	Deciding which purposes need consent.
Keep waiver clauses out	Versioned notices add the rights, withdrawal and Board-complaint block and DPO contacts automatically to every version.	Reviewing your policy wordings and forms.
Prove consent if a customer or the Board asks	Every choice is signed and hash-chained against the exact notice version, with a receipt and an evidence pack.	Keeping proposal and claims records.
Record consent taken by an agent, POSP or call centre	Record consent captured elsewhere with its source, marked as not verified by the customer. Or show the hosted consent page by QR code so the customer gives consent on their own phone.	Collecting the form or recording.
Check consent before every sales call	Call the verify API; it returns not permitted immediately after a withdrawal.	Wiring it into your dialer and DND checks.
Make TPAs, brokers and call centres stop too	The processor registry links each partner to purposes and data items, flags contract expiry, and sends signed webhooks. Partners confirm withdrawals and erasures; erasure stays open until they do.	Signing and enforcing the contracts.
Offer notices to rural and regional customers	Notices in English and all 22 Eighth Schedule languages, with machine-translation drafts flagged for review.	Reviewing the translations.
Run retention	Set retention per purpose; the retention job ends access and alerts linked processors; retention obligations such as IRDAI records show in the notice.	Deleting rows in policy and claims systems.
Handle access, erasure, grievances and nomination	A rights inbox with SLA timers; erasure closes with a structured proof; nomination and nominee claims are built in.	The answers and the policy-side changes.
Handle child plans and guardians	Guardian verification through DigiLocker and lawful-guardian links for persons with disability, with operator review; a family view in the person’s app.	Your underwriting rules for children.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices to affected people, and Board intimation and report documents.	Detection, investigation, and CERT-In and IRDAI reporting.

myconsentapp is a proposed Consent Manager. It does not exchange claims documents with hospitals or TPAs, does not integrate with policy administration systems out of the box (you connect it through the API and webhooks), and does not include data discovery, a security programme, a DPIA workflow (only a template) or legal advice.

Common mistakes

• Keeping a declaration that waives the right to complain, or deems consent to “all purposes”.
• Buying leads without any way to show that the person agreed to be called.
• Emailing discharge summaries and medical reports between TPAs, hospitals and claims teams.
• Sending full medical files to reinsurers when a summary would do.
• Using nominee contact details for marketing.
• Letting agents fill in health answers and tick consent boxes for customers.
• Keeping declined proposals and medical reports forever.
• Confusing DPDP nomination with policy nomination.

Frequently asked questions

Is health data a special category under DPDP? The Act does not create separate categories of sensitive data. It treats all personal data under the same rules. Health data still carries the highest risk if leaked, and the Board must weigh the type and nature of the data affected when deciding a penalty (section 33(2)(b)). Treat it with your strictest controls.

Can a policy say the customer waives the right to complain to the Board? No. The Act’s own illustration under section 6(2) is an insurer that takes consent to issue a policy and to a waiver of the right to complain to the Board. The waiver part is invalid. Remove such clauses.

Do we need consent to settle a claim? Usually not. The claimant voluntarily provides data to have the claim settled, which fits section 7(a). Share with hospitals, TPAs and investigators only what the claim needs, and say so in the notice.

Can we send policyholder data to a reinsurer abroad? DPDP allows transfers abroad subject to government requirements (rule 15). Section 16(2) keeps any stricter sector rule in force, and IRDAI rules may require some records to stay in India. Share the minimum and record each transfer. Confirm the current requirement with counsel.

Who gives the notice in group insurance, the employer or the insurer? Both, for their own roles. The employer shares employee data for a benefit the employee seeks, which fits 7(i). You, as insurer, give insured members a notice at enrolment that covers their own and their dependants’ data.

Can we call leads bought from an aggregator? Only if you can show the person consented to being contacted by you or a category that includes you, and has not withdrawn. Ask for the consent record with each lead, and check DND too.

How is DPDP nomination different from policy nomination? Policy nomination under insurance law decides who receives the claim money. DPDP nomination (section 14) lets a person name someone to exercise their data rights on their death or incapacity. They can be the same person, but they are different choices.

Are we likely to be a Significant Data Fiduciary? Large insurers process high volumes of health and financial data, which is the kind of factor section 10(1) names. No SDF list has been published yet. Plan as if you will be notified: a DPO based in India, an independent data auditor, and a DPIA and audit every 12 months under rule 13.