Your agent's phoneis part of your data estate.

Insurance data travels further than any other: agent, broker, insurer, TPA, hospital, reinsurer, and back.

In one line: When they collect and handle customer data on behalf of an insurer, they generally act as Data Processors, and the insurer remains responsible. Some brokers may act as independent fiduciaries for their own purposes.

The estate · InsuranceHover to inspect

The policy is yours. The proposal form is on someone's WhatsApp.

The scene

The proposal form was filled in at a customer's home, photographed by the agent, sent to a branch group chat, uploaded by an assistant, and emailed to underwriting. Five copies before the policy was issued. One company controlled one of them.

Where the thinking breaks

The unclear thoughtWhat it breaksThe clearer thought
Agents are regulated separately. Agent licensing is not a data processing contract. Govern agents' data handling as processing on your behalf.
Claims data is the TPA's responsibility. TPAs process for you; their failure is your exposure. Contract, audit and rehearse with every TPA.
We need everything for underwriting. Section 6 limits consent to data necessary for the purpose. Collect for the risk, not for the file.

After the claim closes

Claims files carry diagnoses, bank details and family information. Retention should follow the law and the limitation period, then end.

The full Insurance briefing

3 deep dives
Deep dive 01→

Five copies before the policy issues.

The agent carries your brand and your liability in the same bag.
Deep dive 02→

The claims file is the most sensitive file you own.

The Act has no ‘sensitive’ label. The Board will know sensitive when it sees it.
Deep dive 03→

Collect for the risk, not for the file.

What you never collected can never leak.

Monday morning

  1. 01Trace one proposal form from home visit to policy issue.
  2. 02Count the copies.
  3. 03Close the channel with the most copies first.

Questions, answered plainly

Are insurance agents and brokers Data Processors under DPDPA?

When they collect and handle customer data on behalf of an insurer, they generally act as Data Processors, and the insurer remains responsible. Some brokers may act as independent fiduciaries for their own purposes.

Can insurers keep claims data indefinitely under DPDPA?

No. Data should be erased once its purpose is served, unless retention is required by law. Insurers should align retention with regulatory requirements and limitation periods.

Sector · HR & StaffingThe candidate you never hired is still your Data Principal.Read → Sector · Hospitality & TravelGuests check out. Their passports stay.Read → Sector · GamingYour fastest-growing segment may legally be children.Read →

Tell us where your data sits.We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner