privy Archives

Background Verification

India’s Insurance Rules Just Changed Forever: What the IRDAI Reforms Mean for You in 2025–26

Introduction: India’s Insurance Sector Is Getting a Complete Makeover

If you work in insurance — as an agent, insurer, intermediary, or compliance officer — 2025 and 2026 are years you will not forget. India has passed its most sweeping insurance law reform in decades, and IRDAI (Insurance Regulatory and Development Authority of India) has followed up with a series of regulations that touch every part of how insurance is sold, distributed, and governed.

The changes are not just bureaucratic tweaks. They fundamentally alter who can participate in the insurance market, how agents and intermediaries get registered, how compliance is monitored, and what technology platforms must be used to sell insurance. At the same time, new “Fit & Proper” criteria mean tighter background checks for key personnel across every insurance company and intermediary.

This guide breaks down three major regulatory developments — the Sabka Bima Sabki Raksha Act 2025, the Bima Sugam Marketplace Regulations 2024, and the Fit & Proper Criteria under the IRDAI Corporate Governance Regulations 2024 — in plain language, explains what has changed, and explores what it means for compliance teams and businesses operating in this space.

Part 1: The Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025

What Is It?

“Sabka Bima Sabki Raksha” translates to “Insurance for All, Protection for All” — and the name reflects the ambition behind this legislation. Passed by both Houses of Parliament on December 18, 2025, and given Presidential assent on December 20, 2025, this Act amends three foundational laws of India’s insurance ecosystem:

The Insurance Act, 1938
The Life Insurance Corporation Act, 1956
The Insurance Regulatory and Development Authority Act, 1999

The Act came into force on February 5, 2026, and it has already begun reshaping how the industry operates.

What Has Changed:

1. Perpetual Registration for Intermediaries — The End of the 3-Year Renewal Cycle

Previously, insurance agents and intermediaries had to renew their licences every three years. This periodic renewal system created predictable compliance windows but didn’t ensure that someone who passed a background check in year one remained clean through years two and three.

Under Section 42D of the amended Insurance Act, fixed-term licences are replaced with perpetual (lifetime) registrations, subject to annual fee payments and ongoing compliance requirements.

What this means in plain language: An agent no longer has a licence that “expires” after three years. Instead, they remain registered indefinitely — but they must stay compliant year after year. This shifts the burden from a one-time check at renewal to a continuous compliance obligation.

IRDAI has moved from a renewal-based model to an annual fee-based perpetual registration regime. The three-year checkpoint is gone; continuous compliance is now the baseline.

2. Composite Licence and New Business Models

The Act expands who can operate as an insurance intermediary by widening the definition to include Managing General Agents (MGAs) — a business model common in global insurance markets where a specialised company underwrites policies and manages claims on behalf of an insurer.

This opens the door for new types of players to enter India’s insurance market, bringing global underwriting expertise and technology-driven distribution models.

3. 100% FDI in Insurance Companies

One of the most talked-about provisions is the increase in the Foreign Direct Investment (FDI) limit from 74% to 100% in Indian insurance companies. This means a foreign company can now own an Indian insurance company outright.

The practical impact: more foreign capital, global best practices, and advanced technology entering the Indian market — all of which accelerate the push for digitisation and rigorous compliance standards.

4. Stronger IRDAI Powers

The Act gives IRDAI new powers including disgorgement (the ability to claw back ill-gotten gains from violators), more streamlined rule-making processes, and a clearer framework for mergers, demergers, and acquisitions in the sector.

Why This Matters for Compliance Teams

The shift from renewal-based to perpetual registration changes compliance from an episodic activity to an ongoing one. A background check done at the time of agent onboarding is no longer sufficient. Compliance teams must now maintain real-time visibility into whether their agents, sub-agents, and intermediaries remain eligible throughout their tenure.

Consider the risk: a registered agent who develops a financial default, faces a criminal charge, or loses a professional certification after onboarding does not automatically lose their registration under the old system. Under the new perpetual regime, they remain registered — unless someone is actively monitoring for such changes.

This is precisely where continuous monitoring and periodic re-verification becomes a regulatory and risk imperative rather than just a best practice.

Part 2: IRDAI (Bima Sugam — Insurance Electronic Marketplace) Regulations, 2024

What Is Bima Sugam?

Bima Sugam is India’s new Digital Public Infrastructure for insurance — think of it as the UPI of the insurance world. Just as Unified Payments Interface (UPI) made digital payments seamless and universal, Bima Sugam is designed to make buying, selling, renewing, and managing insurance policies as easy as using an app.

Notified by IRDAI on March 21, 2024, and governed by the IRDAI (Bima Sugam — Insurance Electronic Marketplace) Regulations, 2024, the platform is operated by the Bima Sugam India Federation (BSIF), a not-for-profit entity incorporated under Section 8 of the Companies Act, 2013.

Phase 1 of Bima Sugam went live in December 2025, beginning with e-KYC capabilities and select insurance products.

What Does Bima Sugam Do?

At its core, Bima Sugam is a one-stop platform where:

Customers can compare and purchase all types of insurance (life, health, motor, property, travel, agriculture)
Agents and intermediaries can onboard customers digitally
Policies can be issued, serviced, and claims can be settled — entirely online
Every policyholder receives a Bima Pehchaan ID — a unique digital identity linked to Aadhaar/PAN that serves as permanent, portable KYC across all insurance transactions

The platform is built on India Stack APIs, integrating Aadhaar-based e-KYC, PAN verification, consent-based data sharing, and digital payment rails. It is certified under ISO 27001:2022 and ISO 27017:2015 and is compliant with the Digital Personal Data Protection (DPDP) Act, 2023.

What Has Changed for Agents and Insurers?

Insurers are required to list their products on Bima Sugam and make all policy services — including claims and grievance redressal — available through the platform. For agents and intermediaries, this means they must be digitally integrated and validated to operate on this marketplace.

This creates a new class of compliance requirement: real-time digital identity validation. In order to onboard an agent onto Bima Sugam, an insurer or intermediary must verify:

Aadhaar-based identity (with liveness detection)
PAN or other identity documents via OCR
Compliance with IRDAI registration and Fit & Proper criteria

Given that Bima Sugam processes sensitive financial and health data for millions of policyholders, the platform demands that every participant in the ecosystem — from insurer to agent to aggregator — meets a verifiable compliance standard before they can transact.

The Technology Implication

Traditional paper-based or manually-processed agent onboarding workflows are incompatible with Bima Sugam. To operate on this marketplace, insurers need API-based RegTech solutions capable of:

Video KYC with liveness checks
Aadhaar-based e-KYC for instant identity verification
PAN and document OCR for fast, accurate data extraction
Real-time database lookups to validate agent credentials with IRDAI records

The shift to digital-first distribution is permanent. Bima Sugam is not an option — it is the infrastructure through which India’s insurance market will increasingly operate.

Part 3: Fit & Proper Criteria — IRDAI Corporate Governance & Intermediaries Regulations, 2024

What Are “Fit & Proper” Requirements?

Every regulated industry has some version of a “Fit & Proper” standard — a set of criteria that key individuals (directors, principal officers, and other decision-makers) must meet to be considered suitable for their roles. In insurance, this matters enormously because agents and intermediaries handle public funds, make representations about risk, and can cause significant consumer harm if they operate unethically.

Under the IRDAI Master Circular on Corporate Governance for Insurers, 2024, the Fit & Proper criteria have been significantly strengthened and made more specific. Similar requirements apply to intermediaries under the IRDAI (Insurance Intermediaries) Regulations.

What Must Be Verified?

For principal officers, directors, and corporate agents, the regulations require verification across multiple dimensions:

Criminal Record Checks

An individual is disqualified if they have been convicted of an offence involving moral turpitude, fraud, or financial dishonesty. This requires a jurisdictional court record verification (CCRV) — checking court databases across the relevant states and districts where the individual has lived and worked.

Financial Integrity Checks

Disqualifications include having been declared insolvent, defaulting on loan repayments, or being barred by any financial sector regulator. This translates to the need for CIBIL score checks, RBI defaulter list checks, SEBI debarment checks, and similar financial background lookups.

Professional Certification and Training Verification

Before an agent can sell insurance, they must complete a prescribed number of training hours. The 2024 regulations specify mandatory training of 25 to 50 hours depending on the category of licence, along with examinations conducted through IRDAI-approved institutions. Compliance teams must be able to verify that these training requirements have been genuinely fulfilled — not just self-declared.

Education and Qualification Verification

For senior roles, educational credentials must be independently verified to ensure candidates meet the minimum qualification standards set by IRDAI.

What Has Changed?

Before the 2024 regulations, Fit & Proper checks were largely conducted at the point of appointment and left to the discretion of individual insurers. The new framework:

Makes the criteria explicit and standardised across the industry
Requires insurers and intermediaries to document their screening process and make it auditable
Extends the obligation to include not just employees but directors and key management personnel of corporate agents

In practical terms, a compliance officer can no longer rely on a self-declaration form. Verification must be supported by independent, documented evidence from credible sources — which is precisely the gap that purpose-built leadership and intermediary screening tools like AuthLead are designed to fill

Part 4: What These Regulations Mean Together — The Big Picture

Reading these three regulatory developments together, a clear direction emerges:

India’s insurance sector is moving from periodic, paper-based compliance to continuous, digital, evidence-based compliance.

The Sabka Bima Sabki Raksha Act replaces episodic licence renewals with perpetual registration — meaning compliance must be maintained and monitored every day, not just at renewal time.

Bima Sugam requires digital integration and real-time identity validation for every agent and intermediary who participates in the marketplace.

The Fit & Proper criteria codify what must be verified, for whom, and through what kind of evidence.

Together, they create an environment where one-time onboarding checks are no longer adequate. Insurers who rely on a background check done at the time of agent recruitment — and never revisit it — are now exposed to significant regulatory and reputational risk

Part 5: How Continuous Verification Addresses the New Compliance Reality

From Pre-Employment Screening to Continuous Monitoring

The traditional background verification model is built around a hiring event. A candidate applies, a BGV is conducted, and if it clears, the person is onboarded. After that, the file is closed.

This model made sense when licences expired and renewal was the compliance trigger. But under perpetual registration, the compliance trigger is every day.

Consider the lifecycle of an insurance agent under the new regime:

Day 1: Agent is onboarded. Aadhaar KYC, PAN verification, criminal record check, CIBIL check, and training certificate validation are all completed.
Year 1: Agent operates without incident. No flags.
Year 2: Agent defaults on a business loan. Their name appears on a financial defaulters list.
Year 3: Agent files a case in a local court, or becomes subject to a regulatory inquiry.

Under the old system, none of this would be caught until the next renewal cycle. Under perpetual registration with no mandatory re-verification trigger, it could go undetected indefinitely — unless the insurer has a system actively monitoring for such changes.

What Continuous Verification Looks Like in Practice

Periodic Criminal/Financial Screening: Rather than a one-time check, agents are screened against criminal record databases and financial defaulter lists on a regular schedule — quarterly, semi-annually, or annually based on risk category.

Re-KYC and Identity Refresh: Aadhaar and PAN-linked identity checks are refreshed periodically, ensuring that the digital identity on file remains valid and that the person remains who they claim to be. Secure storage and audit-ready retrieval of these re-verification records is critical — a capability that platforms like AuthBridge Vault are built to provide.

Training and Certification Monitoring: As IRDAI mandates ongoing training hours and periodic re-examination for certain licence categories, compliance systems must track whether agents are keeping their certifications current.

Regulatory Debarment Monitoring: Agents and key personnel are monitored against IRDAI, SEBI, RBI, and other regulatory debarment lists in real time, so that any action by another regulator is immediately flagged.

AuthLead, Continuous Monitoring, and Re-KYC: Solutions Built for This Regulatory Moment

This is where purpose-built compliance technology becomes critical. Tools like continuous BGV platforms, Re-KYC solutions, and regulatory watchlist monitoring are no longer optional features for ambitious compliance teams — they are the infrastructure required to meet the obligations created by perpetual registration and the Fit & Proper framework.

Specifically, an end-to-end compliance solution for the new IRDAI regime should offer:

For Bima Sugam Readiness:

Aadhaar-based Video KYC with liveness detection
PAN and document OCR for instant data extraction
API-based integration with insurer and aggregator platforms for seamless onboarding

For Fit & Proper Compliance:

Court record verification (CCRV) covering jurisdictions across India
CIBIL and financial default checks
Education and professional certification verification, including training hours under IRDAI mandates
Regulatory debarment and watchlist screening (IRDAI, RBI, SEBI, CIBIL)
For principal officers and directors, AuthLead offers a structured leadership verification framework that maps directly to IRDAI’s Fit & Proper requirements

For Perpetual Registration Monitoring:

Scheduled periodic re-verification of criminal records and financial standing
Real-time alerts when an agent appears on a defaulter or debarment list
Automated compliance dashboards tracking the status of every agent in the network
Audit trails that demonstrate ongoing compliance to IRDAI inspectors

For Re-KYC Under Bima Sugam:

Periodic digital identity refresh linked to Bima Pehchaan ID
Consent-based re-verification workflows that are frictionless for the agent
Integration with India Stack APIs for instant, verified updates
Encrypted, audit-ready storage of all verification records via AuthBridge Vault

By prabhat, 1 weekMay 29, 2026 ago

Background Verification

India’s DPDP Act Explained Without the Legal Jargon

DPDP in 60 Seconds

The Digital Personal Data Protection Act (DPDP Act) is India’s first comprehensive data privacy law. In plain English — if your business collects data about Indian users, you now have legal obligations on how you handle it.

Why it matters: India has over 900 million internet users. Until now, there was no strong law protecting what companies could do with their data. That changes with DPDP.

Three things every business needs to do:

Ask for clear, specific consent before collecting data
Use data only for the purpose you said you would
Respect users’ rights to access, correct, or delete their data

That’s the core of it. The rest of this blog breaks it all down.

Introduction: India Just Joined the Global Privacy Revolution

Think about the last time you downloaded an app. You probably tapped “I Agree” on a 47-page terms document without reading a word of it. And somewhere in that document, the company quietly got permission to collect your location, share it with partners, and use it for ads.

That era is ending — globally, and now in India too.

Over the last decade, countries have been drawing hard lines around data privacy. Europe did it with GDPR in 2018. California followed with CCPA. Singapore has its PDPA. These laws fundamentally shifted the relationship between businesses and users — from “we own your data once you hand it over” to “you always own your data, and we’re just borrowing it.”

India, with one of the world’s largest and fastest-growing digital populations, was conspicuously absent from this list. Not anymore.

The Digital Personal Data Protection Act, 2023 is India’s answer. And with the DPDP Rules released in 2025, enforcement is no longer a distant hypothetical. It’s on the calendar.

Data privacy is a trust problem. Users are getting smarter. They know their data has value. They’re increasingly choosing products that respect their privacy. Companies that get ahead of DPDP aren’t just avoiding fines — they’re building a competitive moat. The ones that drag their feet aren’t just risking penalties. They’re risking their reputation.

Check Out Our Free DPDP Audit Tool

What Is the DPDP Act?

The Digital Personal Data Protection Act, 2023 was passed by the Indian Parliament and received Presidential assent in August 2023. It is India’s first dedicated law governing how personal data of Indian citizens can be collected, stored, processed, and used.

Before DPDP, India had fragmented privacy protections scattered across the IT Act, 2000 and its rules. There was no unified framework, no clear user rights, and no dedicated regulator. Businesses largely operated on the principle of “collect everything, figure out the rules later.”

DPDP changes that. In one sentence: if you collect data about Indian users, you must collect it with consent, use it responsibly, protect it properly, and give users meaningful control over it.

The law is overseen by the Data Protection Board of India (DPBI) — an independent body empowered to investigate complaints, conduct inquiries, and levy penalties on those who violate the Act.

A helpful way to think about it: Just like FSSAI tells food companies what’s safe to put in your food, the DPDP Act tells businesses what’s safe to do with your data.

The detailed operational rules — the DPDP Rules, 2025 — were released by the Ministry of Electronics and Information Technology (MeitY) and specify exactly how businesses must implement the law.

5 Terms That Run the Entire DPDP Act (Explained Like You’re Not a Lawyer)

You don’t need to read the Act in full. But five terms come up constantly, and if you understand these, you understand 80% of DPDP.

1. Personal Data Any information that can identify a person — directly or indirectly. This includes obvious things like your name and phone number, and less obvious things like your IP address, device ID, or location data. If the data can be traced back to a specific individual, it’s personal data.

2. Data Principal That’s you — the individual whose data is being collected. Under DPDP, the Data Principal has real rights: to know what data is collected, to correct it, to ask for it to be deleted, and to withdraw consent. Think of it as the law recognising you as the owner of your own information.

3. Data Fiduciary The business or organisation that collects and decides how to use your data. Zomato collecting your delivery address? Data Fiduciary. Your hospital storing your health records? Data Fiduciary. Your employer storing your payroll details? Data Fiduciary. Most of the obligations under DPDP fall on this entity.

4. Data Processor A third party that processes data on behalf of a Data Fiduciary. For example, if Zomato uses a cloud analytics company to process your order history, that analytics company is the Data Processor. They don’t decide what to do with the data — the Fiduciary does — but they’re still bound by contractual obligations under the Act.

5. Consent Manager A new concept introduced by DPDP. A Consent Manager is a registered entity through which a user can give, review, and withdraw consent across multiple platforms — like a centralised privacy dashboard. Think of it as a single control panel for all your data permissions.

One more worth knowing — Significant Data Fiduciary (SDF): The government can designate certain companies as SDFs based on the volume or sensitivity of data they handle. Think large social media platforms, major fintech companies, healthcare aggregators. SDFs face additional obligations like mandatory Data Protection Officers and impact assessments.

Is This Personal Data? Here’s How to Tell (With Real Examples)

One of the most common questions businesses ask: “Does this count as personal data?”
The short answer — if it can identify a person, even indirectly, it likely does

Clearly personal data:

Name, email address, mobile number
Date of birth, home address
PAN card, Aadhaar number
Bank account details, UPI ID
Location data from your phone
IP address and device identifiers
Biometric data (fingerprints, face scans)

Less obvious but still personal data:

Your cab booking history (your movement patterns)
Your OTP (tied to your number and identity)
Browsing behaviour linked to an account
A photo that contains your face
Inferred data — e.g., “this user is likely diabetic” based on purchase patterns

The gray areas:

Anonymised data: Genuinely anonymised data (where re-identification is impossible) is outside DPDP’s scope. But most “anonymised” data isn’t truly anonymous — it can often be re-identified when combined with other datasets.
Aggregated data: Data like “60% of our users are in Maharashtra” is not personal data. But the individual records that make up that aggregate are.

Children’s data gets special treatment. Under DPDP, anyone under 18 is treated as a child, and their data requires verifiable parental consent. Businesses cannot target children with behavioural advertising, and they cannot profile them.

Real check: Your salary slip uploaded to an HR platform? Personal data. Your resume uploaded to a job portal? Personal data. Even the city you mention in a customer support chat could qualify in context.

The DPDP Rules 2025 Are Out — Here's What Actually Changed

The DPDP Act was the framework. The DPDP Rules, 2025 are the how-to manual. Released by MeitY, they fill in the operational details that businesses were waiting for.

Here’s what changed and what it means:

1. Consent notices got stricter (and clearer) The Rules specify that consent notices must be in plain language, available in scheduled Indian languages, and must clearly state: what data is being collected, why, and for how long. No more legalese buried in 40-page privacy policies.

2. Consent Managers are now real The Rules define how Consent Managers must be registered, operated, and audited. This creates an entirely new category of compliance infrastructure — and a new business opportunity for platforms that can manage consent at scale.

3. Children’s data verification has a framework Businesses that knowingly or unknowingly process children’s data must now have a mechanism to verify the user’s age and obtain parental consent. The specific technical mechanism is still evolving, but the obligation is live.

4. Data localisation requirements were relaxed (conditionally) Earlier drafts were stricter about data being stored only within India. The 2025 Rules take a more nuanced approach — cross-border data transfer is allowed except to countries specifically blocked by the government. This is better news for global businesses and SaaS companies.

5. Grievance redressal timelines are locked in Businesses must now resolve user complaints within defined timeframes. Users who are unsatisfied can escalate to the Data Protection Board.

What’s still coming: Sector-specific guidance (for healthcare, fintech, etc.) and the formal list of designated Significant Data Fiduciaries are still awaited. The regulatory framework is live, but it’s still maturing.

Does DPDP Apply to Your Business? Here's a Simple Checklist

The DPDP Act has a wide reach — wider than most businesses realise.

It applies to you if:

You collect, store, or process digital personal data of Indian residents
You’re a foreign company that handles data of users located in India
You’re a startup, SME, or large enterprise — size doesn’t create an exemption

It does not apply to:

Personal or household data processing (a family WhatsApp group is safe)
Data made publicly available by the person themselves
Government processing for national security, law enforcement, and similar purposes (with conditions)
Research, archival, and statistical purposes — under specific safeguards

The global company question: This is where many international businesses are caught off guard. If you’re a US-based SaaS company with Indian users, DPDP applies to you. Just like GDPR applied to non-European companies with European users, DPDP follows the data, not the company’s geography.

Sectors with highest immediate impact:

Fintech & Banking — KYC data, transaction history, credit profiles
Healthtech — Patient records, diagnostics, insurance data
Edtech — Student data, often including minors
E-commerce — Purchase history, addresses, payment data
HR & Recruitment — Employee and candidate data at scale
AdTech — Behavioural data, profiling, targeting

Quick self-check: Do you collect names, emails, phone numbers, or any other information from Indian users digitally? Then DPDP applies to you. Full stop.

Consent Requirements

Consent under DPDP must be:

Free — No coercion or bundling (“accept everything or you can’t use the app” is no longer valid)
Informed — The user must know exactly what they’re consenting to
Specific — One consent cannot cover every possible use of data
Unambiguous — No pre-ticked boxes, no implied consent
Revocable — Users must be able to withdraw consent as easily as they gave it

Example: A job portal collecting your resume for job matching cannot use that same consent to send you marketing emails or share your profile with third-party recruiters unless you separately agree to that.

Data Minimisation

Collect only what you genuinely need for the stated purpose. Nothing more.

Example: A food delivery app needs your delivery address and phone number. It does not need your Aadhaar number, your date of birth, or access to your full contacts list. Asking for more than you need is a violation.

User Rights (Data Principal Rights)

Users now have legally enforceable rights:

Right to Access: Users can ask what personal data you hold about them
Right to Correction: Users can ask you to fix inaccurate data
Right to Erasure: Users can ask you to delete their data (subject to legal retention requirements)
Right to Grievance Redressal: Users can file complaints if their rights are violated
Right to Nominate: Users can nominate someone to exercise these rights on their behalf in case of death or incapacity

Businesses must have a clear, functional mechanism to handle these requests within defined timeframes.

Security Obligations

The Act requires Data Fiduciaries to implement “reasonable security safeguards” to prevent data breaches. If a breach occurs, you must notify the Data Protection Board and affected users without unreasonable delay.

What counts as reasonable: Encryption, access controls, regular audits, and breach detection systems are baseline expectations. The bar will rise as the rules mature.

Additional Obligations for Significant Data Fiduciaries

If your company is designated as an SDF, you have extra obligations:

Appoint a Data Protection Officer (DPO) based in India
Conduct periodic Data Protection Impact Assessments (DPIAs)
Undergo independent audits
Avoid using personal data for training AI/ML models without explicit consent (proposed)

What Happens If You Don't Comply? The Penalty Breakdown

DPDP is not a law with criminal liability — you won’t go to jail for a data breach. But the financial penalties are significant enough to hurt any business.

Penalty tiers under the Act:

Violation	Maximum Penalty
Failure to implement adequate security safeguards	₹250 crore
Failure to notify a data breach	₹200 crore
Violation of children’s data protection rules	₹200 crore
Non-compliance with Data Principal rights	₹50 crore
General non-compliance	₹50 crore
Frivolous complaints by Data Principals	₹10,000

Who decides: The Data Protection Board of India (DPBI) has the authority to investigate complaints, summon parties, and impose penalties. Decisions can be appealed to an Appellate Tribunal, and further to the High Court.

Important nuance: These are maximum penalties — the Board will consider the nature, gravity, duration, and intent behind the violation before deciding the actual fine. A startup that unknowingly missed a consent requirement will likely be treated differently from a large platform that knowingly ignored user rights.

The risk isn’t just financial. Regulatory investigations are public. The reputational damage from being in the DPBI’s crosshairs could cost far more than the fine itself.

DPDP vs GDPR: Same Spirit, Different Rules

If your business is already GDPR-compliant, you have a head start — but DPDP is not identical to GDPR. Here’s how they compare:

Factor	DPDP Act (India)	GDPR (EU)
Scope	Indian users’ data, processed digitally	All EU residents’ data
Legal bases for processing	Primarily consent-driven	Consent + legitimate interest + contract, etc.
Data localisation	Conditional (blocked countries list)	Not required
DPO requirement	Only for Significant Data Fiduciaries	Required for large-scale processing
Right to data portability	Not explicitly included	Explicitly included
Children’s age threshold	Under 18	Under 16 (varies by country)
Maximum penalty	₹250 crore (~$30M)	€20 million or 4% of global turnover
Criminal liability	No	In some member states

Key takeaway: DPDP is inspired by GDPR but is lighter on compliance burden in several areas. However, India’s reliance on consent as the primary legal basis is stricter in some ways — GDPR allows “legitimate interest” as a basis for processing, which DPDP largely does not.

If you’re already GDPR-compliant, focus on:

Rebuilding consent flows to meet India’s specific requirements
Adding user rights mechanisms for Indian users
Reviewing cross-border data transfer protocols

DPDP Compliance Timeline: What's Already Active and What's Coming

Here’s where things stand as of 2025:

August 2023: DPDP Act passed and notified. The law exists, but enforcement rules are pending.

2025: DPDP Rules released by MeitY. The operational framework is now live. Businesses have no excuse for not knowing what’s required.

Now – Mid 2025: Awareness and early preparation phase. Businesses are expected to begin building compliance infrastructure. The Data Protection Board is being constituted.

Mid 2025 onwards: Enforcement begins phasing in. Significant Data Fiduciaries are expected to be notified. Consent Manager registrations begin.

Full Enforcement: Penalties become fully applicable. At this point, there is no “we’re still figuring it out” defence.

What happens if you delay: The DPDP Act does not come with an indefinite grace period. Once enforcement notifications go out, the clock runs. Businesses caught without basic compliance infrastructure — no consent mechanisms, no user rights workflows, no breach response plan — will be the first targets.

The Board is expected to make early examples. Don’t be one of them.

Your DPDP Compliance Roadmap: A Practical 18-Month Plan

Compliance sounds overwhelming until you break it into a sequence. Here’s a realistic roadmap:

Months 1–3: Audit and Understand

Before you fix anything, understand where you stand.

Data mapping: Document every type of personal data you collect, where it comes from, where it’s stored, who has access, and who you share it with
Gap analysis: Compare your current practices against DPDP requirements
Risk prioritisation: Identify your highest-exposure areas — children’s data, health data, and financial data need to be fixed first
Appoint a data privacy lead internally — even if it’s a part-time role for now

Months 4–6: Policy and Consent Overhaul

Fix the front-end of your data collection.

Rewrite your privacy notice in plain, simple language — no more legalese
Rebuild consent collection across all touchpoints (app sign-ups, website forms, checkout flows)
Ensure consent is specific, revocable, and documented
Update all vendor contracts to include data processing obligations
Build a mechanism for users to withdraw consent easily

Months 7–12: Technical and Operational Implementation

This is where the work becomes engineering work.

Build user rights request workflows — how users submit access, correction, or deletion requests, and how your team processes them within the required timeframe
Implement breach detection and notification protocols
Set up a formal grievance redressal mechanism with clear escalation paths
If you’re an SDF: conduct a Data Protection Impact Assessment, appoint a DPO, prepare for audit

Months 13–18: Test, Train, and Sustain

Compliance isn’t a one-time project. It’s an ongoing practice.

Train your teams — customer support, marketing, product, HR all touch personal data and need to understand their obligations
Run mock audits — simulate a user rights request, a data breach, and a regulatory complaint to test your readiness
Establish a review cadence — quarterly privacy reviews as the regulatory framework continues to evolve
Monitor regulatory updates — DPDP Rules will continue to be refined. Subscribe to MeitY notifications and Board circulars

The Bottom Line: DPDP Is Not Optional — But It's Also an Opportunity

Here’s the thing about every major data privacy law in history — GDPR, CCPA, PDPA — the businesses that treated compliance as a minimum bar lost. The ones that treated it as a chance to build genuine user trust won.

DPDP is India’s moment to reset the relationship between businesses and the people whose data they rely on. Your users are about to have real legal rights. The businesses that respect those rights proactively — before they’re forced to — will earn something no marketing budget can buy: trust.

The law is live. The rules are out. The only question is whether you’re getting ahead of it or waiting to be caught behind.

Before You Close This Tab — Find Out Where You Actually Stand

Reading about DPDP is step one. Knowing whether your website is already exposed is step two.

Most businesses assume they’re fine — until they actually check. A missing consent banner, a privacy notice written in 2019, a third-party script silently collecting user data in the background — these are the gaps that regulators notice first.

We built the DPDP Readiness Report to give you that answer in minutes, not months.

Point it at your domain, and it audits your:

Webpage and data flows — what’s being collected, by whom, and whether consent exists for it
Privacy notice — whether it meets DPDP’s plain language and disclosure requirements
Loopholes and gaps — exactly what’s non-compliant and what to fix first

You get a clear, prioritised report — not a generic checklist, but a diagnosis specific to your domain.

[Run Your Free DPDP Readiness Report →]

No sign-up needed to get started. Takes under 2 minutes.

By prabhat, 3 weeksMay 15, 2026 ago

privy

Introduction: India’s Insurance Sector Is Getting a Complete Makeover

Part 1: The Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025

What Has Changed:

1. Perpetual Registration for Intermediaries — The End of the 3-Year Renewal Cycle

2. Composite Licence and New Business Models

3. 100% FDI in Insurance Companies

4. Stronger IRDAI Powers

Why This Matters for Compliance Teams

Part 2: IRDAI (Bima Sugam — Insurance Electronic Marketplace) Regulations, 2024

What Does Bima Sugam Do?

What Has Changed for Agents and Insurers?

The Technology Implication

Part 3: Fit & Proper Criteria — IRDAI Corporate Governance & Intermediaries Regulations, 2024

What Must Be Verified?

Criminal Record Checks

Financial Integrity Checks

Professional Certification and Training Verification

Education and Qualification Verification

What Has Changed?

Part 4: What These Regulations Mean Together — The Big Picture

Part 5: How Continuous Verification Addresses the New Compliance Reality

From Pre-Employment Screening to Continuous Monitoring

What Continuous Verification Looks Like in Practice

AuthLead, Continuous Monitoring, and Re-KYC: Solutions Built for This Regulatory Moment

DPDP in 60 Seconds

Introduction: India Just Joined the Global Privacy Revolution

What Is the DPDP Act?

5 Terms That Run the Entire DPDP Act (Explained Like You’re Not a Lawyer)

Is This Personal Data? Here’s How to Tell (With Real Examples)

The DPDP Rules 2025 Are Out — Here's What Actually Changed

Does DPDP Apply to Your Business? Here's a Simple Checklist

Consent Requirements

Data Minimisation

User Rights (Data Principal Rights)

Security Obligations

Security Obligations

Additional Obligations for Significant Data Fiduciaries

What Happens If You Don't Comply? The Penalty Breakdown

DPDP vs GDPR: Same Spirit, Different Rules

DPDP Compliance Timeline: What's Already Active and What's Coming

Your DPDP Compliance Roadmap: A Practical 18-Month Plan

Months 1–3: Audit and Understand

Months 4–6: Policy and Consent Overhaul

Months 7–12: Technical and Operational Implementation

Months 13–18: Test, Train, and Sustain

The Bottom Line: DPDP Is Not Optional — But It's Also an Opportunity

Before You Close This Tab — Find Out Where You Actually Stand

Sign up for our newsletter

Hi! Let’s Schedule Your Call.

Thank You

We have sent your download in your email.

Case Study Download

Want to Verify More Tin Numbers?

Want to Verify More Pan Numbers?

Want to Verify More UAN Numbers?

Want to Verify More Pan Dob ?

Want to Verify More Aadhar Numbers?

Want to Check More Udyam Registration/Reference Numbers?

Want to Verify More GST Numbers?