IRDAI - Information and Cyber Security Guidelines, 2023 (covering circular, superseded)
AI / PRIVACY / CYBER RELEVANCE
Historical: the insurance-sector cyber baseline from 2023 until the 2026 Guidelines.
AI: ContextualPrivacy: HighCybersecurity: Very High
READ FIRST
- Para 1 - history from the 2017 insurer guidelines
- Para 4 - entities covered and the FY 2022-23 audit timing
- Para 5 - circulars of 2017, 2020 and 2022 superseded
- Status - replaced by the 2026 Guidelines
PURVIEW
Issued revised cyber guidelines for the whole insurance sector after widespread digital adoption and rising cyber incidents. They applied to all insurers including foreign reinsurance branches, intermediaries (brokers, corporate agents, web aggregators, TPAs, IMFs, insurance repositories, ISNPs, corporate surveyors, MISPs, CSCs) and the Insurance Information Bureau. Entities that had already completed their FY 2022-23 security audit had to comply from the next financial year. They superseded the 2017 insurer guidelines and the 2020 and 2022 circulars that extended them to intermediaries. The uploaded file is the two-page covering circular; the Guidelines annexure is not included. The 2023 Guidelines have been replaced by the 2026 Guidelines, and are kept here for history and for the 2025 cyber-incident circular, which builds on them.
Classification and legal status. Circular IRDAI/GA&HR/GDL/MISC/88/04/2023 dated 24 April 2023; revised and replaced by the IRDAI Information and Cyber Security Guidelines, 2026 (circular dated 6 April 2026).