IRDAI (MAINTENANCE OF INFORMATION BY THE REGULATED ENTITIES AND SHARING OF INFORMATION BY THE AUTHOR

IRDAI has issued the regulation titled IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority), Regulations 2025 (“Regulations”) bearing reference number IRDAI/Reg/4/211/2025 dated January 01, 2025, with the objective to enable insurers to maintain data electronically, ensure security and compliance, adopt a data governance framework, facilitate investigation by the Authority, and ensure judicious sharing of information with confidentiality, security, and respect for stakeholders’ rights.

The Regulations repeal the following Regulations-

• IRDAI (Minimum Information Required for Investigation and Inspection) Regulations, 2020
• IRDAI (Sharing of Confidential Information Concerning Domestic or Foreign Entity) Regulations, 2012 and
• IRDAI (Maintenance of Insurance Records) Regulations, 2015.

The key highlights of the Regulations are as under:

Key Definitions-

• For the purpose of these Regulations, the term “Confidential Information” shall mean the information from a foreign entity that shall be kept secret, as requested by the entity or outlined in an agreement/MoU, and for a domestic entity, it is defined by applicable domestic laws.
• For the purpose of these Regulations, the term “Information” regarding a foreign entity refers to data related to a foreign financial regulatory authority or any foreign financial entity, while for a domestic entity, it is defined as per Section 2(f) of the Right to Information Act, 2005.
• For the purpose of these Regulations, the term “Requesting Entity” shall mean entity requesting information relating to a Requested entity.
• For the purpose of these Regulations, the term “Requested Entity” shall mean the domestic or foreign entity whose information is subject of disclosure under these regulations.

Sharing of Confidential Information by the authority concerning Domestic or Foreign Entity-

• The Information sought from the Authority may be categorized into two types: the information available in the public domain from the Authority, regulated entities, or other statutory/public bodies; and the information not available in the public domain but held by the Authority.
• The purpose for seeking information may include carrying out statutory or regulatory functions by Indian regulators, public authorities, domestic bodies like the Government, Judiciary, Law enforcement agencies, or international supervisors, and for general public consumption under Section 20 of the Insurance Act, 1938 or other applicable laws.
• The Authority may disclose information available in the public domain and share non-public information with the Requesting entity only if a written request is made, applicable laws permit sharing, explicit consent from the Requested Entity is obtained, and the Requesting entity ensures the information is used solely for lawful duties.
• The Requests for non-public information shall be assessed based on confidentiality, the purpose of the request, the nature of the information, its commercial sensitivity, and the reciprocity of requests.
• The Authority will consider each request on its merits and reserves the right not to share information that could impact the stability of regulated entities, the insurance sector, or compromise public or policyholder interests.
• The Authority will notify the Requested entity and obtain its prior consent before sharing Confidential Information with local, regional, State, or law enforcement authorities, ensuring that recipients maintain confidentiality and have the legal authority to do so.
• If a legally enforceable request for Confidential Information is made, the Authority will notify the Requested entity before complying and, if consent is not provided, will seek legal means to resist or protect the confidentiality.
• All current and former employees of the Authority with access to confidential information are bound by professional secrecy obligations, and any breach shall lead to action as per applicable laws and the Authority’s code of conduct.

Maintenance of Insurance Records-

• Every insurer shall maintain complete and accurate records of policies issued and claims made, ensuring they are stored electronically with necessary security features and a data governance framework. These records shall be stored in data centres located in India, and access should be provided for inspections and investigations by the Authority. Insurers focused solely on reinsurance shall also adhere to these provisions for record maintenance.
• The insurer shall have a Board-approved policy for maintaining records, including a plan for implementation and annual reviews. The policy should cover security mechanisms, use of up-to-date technology, privacy and confidentiality standards, data processing and maintenance, backups, disaster recovery, business continuity, and compliance with the Authority’s specified regulations.
• Every insurer shall organize records to ensure easy retrieval for business use, supporting policyholder service and compliance with applicable laws, regulations, circulars, guidelines, and other regulatory frameworks.

Minimum Information for Investigation and Inspection-

• Every insurer shall maintain all required records, information, data, documents, and registers at their principal place of business in India, as per the applicable laws and regulations, and ensure compliance with the specified items in Schedule-I of these Regulations, either at the principal office, branches, or data centres in India. Reinsurers are deemed compliant if the information is readily accessible from their records.
• Every intermediary or insurance intermediary shall maintain all required records, information, and documents at their principal place of business in India, as per the applicable laws and the specified items in Schedule-II of these Regulations. If it’s impractical to maintain detailed records at the principal place, they may be kept at branches or data centres in India, ensuring easy access to relevant information.
• Insurers, intermediaries, and insurance intermediaries shall establish a Board-approved policy for maintaining and destroying records, both physical and electronic, based on business needs and legal requirements. Records should be kept for at least 10 years or as per applicable laws, whichever is later, from the last transaction date or policy expiration date, except for those specified under clause 8 of Schedule – I of these Regulations.

A copy of the Regulations is attached for your ready reference.

Source category: IRDAI

Attachments

• IRDAI (Maintenance Of Information By The Regulated Entities And Sharing Of Information By The Author