Skip to main content
Marsh logo

Event

The DPDP Act 2023 & Rules, 2025: Insurance implications

DPDPA and DPDP Rules notified, the actual implementation of the same is now in force.

12/29/2025 · 4 minute read

What’s New in the Final Rules?

With the DPDPA and DPDP Rules notified, the actual implementation of the same is now in force. While the overall framework remains the same, a few important refinements have been introduced that will directly impact how clients treat, access, store and process personal data In simple terms, the final law now bring in:

  1. A uniform baseline retention requirement – one year retention for personal data logs, followed by mandatory deletion unless another law demands longer retention.
  2. Defined grievance timelines – Mandatory resolution timelines now capped at 90 days.
  3. New Defined Terms bringing clarity– Includes “account address”, “unauthorised entity”, “user account”, enabling clearer interpretation of obligations.
  4. A staggered rollout - Board-related provisions kick in immediately, while Consent Manager and full Data Fiduciary obligations such as consent, DSR etc., will phase in over the next 12-18 months.
  5. Retention and inactivity rules - Retains the 3 years inactivity trigger for certain classes, with mandatory 48-hour pre-deletion notice.
  6. Breach reporting clarity – Confirms the two-step model – immediate intimation + detailed report within 72 hours.

Key Provisions

The DPDP Act & Rules, 2025 introduce a formalised framework for personal data treatment in India. Key obligations include:

  1. Mandatory explicit and verifiable consent for all personal data processing activities.
  2. Clear, transparent notices describing data collection purpose and withdrawal mechanisms.
  3. Mandatory breach notifications to affected individuals and to the Data Protection Board (“Board”).
  4. Implementation of prescribed security safeguards, including encryption, access controls and minimum log-retention requirements.
  5. Mandatory data deletion upon completion of purpose, with 48-hour prior notice to the data principal.
  6. Cross-border data transfers permitted, unless specifically restricted through Government notification.
  7. Time-bound regulatory processes, with breach-related inquiries expected to conclude within six months.

Cyber Insurance Impact

The Rules bring several implications for cyber risk, exposure and insurability:

  1. Shorter notification timelines may increase incident-response pressure and compliance costs.
  2. More frequent regulatory reporting to the Board may trigger additional inquiries, affecting defence cost utilisation.
  3. Greater scrutiny of prescribed controls (encryption, access management, log retention) could affect claim defensibility where non-compliance is identified.
  4. Increased exposure from consent failures, vendor lapses and retention failures may drive third-party liability claims.
  5. Clients may need to reassess cyber insurance limits, especially for forensics, PR, legal advisory and notification costs.

Insurability of Penalties under the DPDP Act

3.1 Nature of Penalties

Penalties for significant non-compliance can reach INR 250 crore (approximately USD 30M).

Unlike GDPR, which caps fines, the DPDP Act allows cumulative penalties for multiple provisions breached. The Act places full compliance responsibility on Data Fiduciaries, not the Data Processors acting on their behalf. Processors are not directly liable, but fiduciaries must ensure contractual controls for compliance.

3.2 Indemnity Limitations & Insurability Considerations

While fiduciaries may contractually transfer obligations to processors, contractual indemnity does not resolve insurability challenges. For insurers, clear benchmarks are needed to assess:

  • Whether consent was free, specific, informed and unambiguous
  • Whether personal data was processed only for the defined purpose
  • Whether prescribed technical and organisational safeguards were in place
  • Whether reasonable security controls were maintained to prevent a breach

Given the Act’s nascency, implementation of many activities and obligations are now more structured and many provisions may remain open to industry practice and legal interpretation until judicial precedence emerges.

Where organisations can evidence good-faith efforts and due-diligence, inadvertent non-compliance may remain defensible within the policy structure.

3.3 Global Perspective

EU practice shows divergence — some jurisdictions treat punitive fines as uninsurable, while others allow coverage depending on:

  • Circumstances of breach
  • Conduct of the insured
  • Specific wording of the insurance policy

Indian regulatory interpretation will evolve similarly.

Conclusion

Cyber insurance policies in India do provide a cover for regulatory fines and penalties (where insurable by law) and by way of extension some carriers may also provide cover for “punitive and exemplary damages” as well. Notwithstanding these considerations, however, cyber insurance policy may still comprehensively cover other associated costs in relation to a cyber breach incident, including but not limited to the following:

  • Costs associated with cyber incident management or crisis management;
  • Notification costs;
  • Credit monitoring costs;
  • Public relations;
  • Data restoration/recovery; and
  • Defence costs in relation to any third-party disclosure liability, failure to prevent
  • unauthorized access, failure of system security to prevent a cyber-attack, regulatory
  • response costs, etc.

While clarity on insurability of DPDP Act fines from an enforcement standpoint remains to be witnessed, insurance providers can play a vital role in managing risks and supporting businesses in their efforts to comply with data protection regulations. As the judicial stance becomes clearer, insurance policies can be tailored to address the specific needs and challenges of DPDP Act breaches, providing organisations with the necessary protection and peace of mind. By balancing the need for financial stability and compliance incentives, insurers and regulators can work together to enhance the effectiveness of data protection regulations and to safeguard personal data.

Leadership

Bhishma Maheshwari

Chief Client Officer, Senior Vice President, Communications, Media and Technology Leader, Marsh India 

  

Ritesh Thosani

Cyber Practice Leader, Marsh India

Akshara Sharma

Executive Vice President, Claims Advocacy, FINPRO/Cyber

Debashree Pusti

Assistant Vice President, Claims Advocacy, Cyber

Harshit Saini

Senior Manager, Cyber Practice

This document is not intended to be taken as advice regarding any individual situation and should not be relied upon as such. Marsh shall have no obligation to update this publication and shall have no liability to you or any other party arising out of this publication or any matter contained herein. The information contained herein are based solely on our experience as insurance brokers and risk consultants. Insurance is the subject matter of solicitation. For more details on benefits, exclusions, limitations, terms, and conditions, please read the sales brochure/policy wording carefully before concluding a sale. Marsh makes no assurances regarding the availability, cost, or terms of insurance coverage. Although Marsh may provide advice and recommendations, all decisions regarding the amount, type or terms of coverage are the ultimate responsibility of the insurance purchaser, who must decide on the specific coverage that is appropriate to its particular circumstances and financial position. Insurance coverage is subject to the terms, conditions, and exclusions of the applicable individual policies.

Prohibition of Rebates – Section 41 of the Insurance Act, 1938; as amended from time to time: No person shall allow or offer to allow, either directly or indirectly, as an inducement to any person to take or renew or continue an insurance in respect of any kind of risk relating to lives or property in India, any rebate of the whole or part of the commission payable or any rebate of the premium shown on the policy, nor shall any person taking out or renewing or continuing a policy accept any rebate, except such rebate as may be allowed in accordance with the published prospectuses or tables of the insurer. Any person making default in complying with the provisions of this section shall be punishable with a fine which may extend to ten lakh rupees.

Page Compliance ID