IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regulations, 2025
AI / PRIVACY / CYBER RELEVANCE
India's binding insurance-sector rule on electronic record-keeping, data governance and in-India storage of policy and claims data, the base on which insurer analytics and AI underwriting operate.
AI: ModeratePrivacy: Very HighCybersecurity: High
READ FIRST
- Regulation 2 - objectives, electronic records and data governance framework
- Schedule obligations on insurers - records in electronic form, security features and data governance, policy and claims records in data centres located in India only
- Regulations 5 to 7 - categorisation, purpose and disclosure of information sought by the Authority
- Regulation 8 - sharing of confidential information with notice, prior consent and confidentiality undertakings
PURVIEW
Sets two linked regimes for the insurance sector. First, insurers and intermediaries must keep complete and accurate records - policies, claims, receipts, payments, attendance and claim documents - in electronic form, under a security and data-governance framework reviewed at least annually, with appropriate security mechanisms, up-to-date technology and privacy standards, and protection of the privacy, confidentiality and security of policyholder and claim data. Records of policies issued and claims made in India must be held in data centres located and maintained in India only, and be accessible for IRDAI inspection and investigation. Second, it governs when IRDAI may share confidential information with domestic and foreign regulators: categorisation of information, stated purpose, applicable-law permission, notice to and prior written consent of the entity, and recipient confidentiality undertakings, with IRDAI resisting compelled disclosure where consent is withheld. The Regulations set sectoral record-keeping and data-localisation duties; they do not displace the Data Fiduciary obligations under the DPDP Act, 2023, which apply alongside to policyholders' personal data.
Classification and legal status. Binding IRDAI regulations, F. No. IRDAI/Reg/4/211/2025, notified 1 January 2025 and published 3 January 2025; in force on publication.