Introduction
Insurance is a data intensive sector. Data localisation in India is sometimes described as though it were governed by a single rule requiring all insurance and related data to remain in India. The legal position is, however, more nuanced. The applicable requirements arise under several statutory and regulatory instruments, apply differently to Insurers, Reinsurers, and insurance intermediaries, and attach to particular records, systems, and regulated functions.
Lately, this distinction has assumed greater significance as insurance businesses increasingly rely on sophisticated and group-wide technology platforms for policy administration, claims management, reinsurance, finance and accounting, investment management, HR, customer journeys, and cybersecurity. A single platform may therefore contain data which is subject to different maintenance, retention, security, backup, and inspection requirements. Accordingly, the location of a particular system or platform does not, by itself, determine whether the applicable legal requirements have been met.
This article provides a brief overview of the data localisation framework applicable to insurance entities in India. It examines the relevant insurance regulatory, cybersecurity, data protection, and company law requirements, while highlighting certain practical considerations for regulated entities (without attempting to prescribe any universally compliant system architecture or arrangement).
Insurance Regulatory Framework
Data Localisation Norms
The starting point is the Insurance Act 1938 (Insurance Act). Section 14, in its current form, requires every Insurer, in respect of all business transacted by it, to maintain a complete record of policies, including the policy application, policy contract, and other relevant and connected information, together with a record of every claim1. The Insurance Act separately contains specific requirements concerning the processing, accuracy, security, and confidentiality of policyholder information2. While these statutory requirements do not themselves provide an express data localisation rule, they do form an important part of the norms on how insurance records are maintained and processed.
The IRDAI’s regulatory framework separately requires Insurers, Reinsurers, and insurance intermediaries to maintain a broad range of records. Depending on the regulated entity and its activities, the prescribed records extend beyond policy and claim information to matters such as employees, financial transactions, investments/assets, reinsurance, outsourcing, vendor/payment records, governance documentation, and regulatory correspondence. The more nuanced question that arises, however, is how these records are required to be maintained and whether they must be localised exclusively within India. This question becomes particularly significant where the technology infrastructure adopted by regulated entities, including group-wide systems, is hosted across multiple jurisdictions.
In this regard, we note that the norms on record maintenance and location do not use the same formulation for every regulated entity or every category of record. By way of illustration, and amongst other requirements, the insurance regulatory framework prescribes distinct requirements in relation to:
- the maintenance of policy and claims records in data centres located in India3;
- the hosting of specified financial and investment data on primary servers located in India, alongside broader expectations regarding the technical build of investment management systems4; and
- the localisation of servers hosting an applicant's digital infrastructure, such as the Insurance Self-Network Platform5 (ISNP).
As a further illustration, the Information Regulations demonstrate why “data localisation” is not a single concept under the insurance regulatory framework:
- R9 applies specifically to policy and claim records maintained by Insurers and expressly requires records pertaining to policies issued and claims made in India to be held in data centres located and maintained in India “only”.
- R12 addresses a broader record set for Insurers and requires all records, information, data, documents, books, or registers required under applicable law, together with the information specified in Schedule I, to be maintained in India.
- R13 separately applies to insurance intermediaries and uses similar India-located record keeping language for Schedule II information, but does not reproduce the expression “in India only” appearing under R9 for Insurers.
- The above provisions have been expressly clarified to be applicable to Foreign Reinsurer's Branches (FRBs) and Lloyd's India6.
The prescribed Schedules are also not exhaustive, and the Information Regulations expect regulated entities to maintain all relevant information, documentation, and related papers relating to the functions they carry out7, require electronic maintenance and access during regulatory investigation and inspection8, and require Board-approved policies on record maintenance and retention9.
Where an overseas or group service provider processes information or supports a regulated function, we note that separate outsourcing requirements may also apply, including requirements concerning confidentiality, regulatory access, and maintenance of original policyholder records in India10.
Cyber Security Norms
The IRDAI’s recently issued “Information and Cyber Security Guidelines” of April 2026 (Cyber Security Guidelines) provide a further regulatory overlay and apply to Insurers, Reinsurers, and insurance intermediaries. By way of illustration, the Cyber Security Guidelines contain a number of requirements relevant to data architecture and require regulated entities to:
- classify information based on sensitivity and implement security controls commensurate with the applicable classification, including measures relating to encryption, access management, and secure transmission11;
- establish appropriate contractual safeguards where information is shared with third-parties, including by imposing prescribed information security obligations on service providers12;
- comply with specified requirements when engaging cloud service providers, including requirements relating to recognised certifications, data centre standards, and contractual arrangements13; and
- maintain ICT infrastructure and system logs within India for prescribed retention periods, consistent with the broader CERT-In framework14.
Accordingly, the Cyber Security Guidelines have important implications for the design and operation of technology environments used by regulated entities, particularly where information is processed through cloud-based infrastructure, third-party service providers, or group-wide systems. These requirements must therefore be considered alongside the applicable record maintenance and data localisation obligations.
Adjacent Legal Frameworks
The insurance‑specific backdrop set out above does not operate in isolation. The following legal frameworks also have an important bearing on how entities collect, process, store, and transfer information, and therefore influence the design of data architectures:
- Company Law: The Companies Act 2013 and rules thereunder regulate the maintenance of a company's books of account and other relevant books and papers, including where these are maintained electronically. Where such information is maintained electronically, additional obligations apply, including requirements to back up such information on servers located in India on a daily basis15.
- Existing Data Protection Framework: At present, Section 43A of the Information Technology Act 2000 (IT Act), read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (SPDI Rules) impose various requirements on body corporates handling personal information, including sensitive personal information. These broadly include publishing privacy policies, collecting sensitive personal information only for lawful and necessary purposes with prior consent16, not retaining such information for longer than necessary or as required by law, and implementing certain security safeguards.
- Upcoming Data Protection Framework: Section 43A of the IT Act and the SPDI Rules will stand repealed once the Digital Personal Data Protection Act 2023 (DPDP Act) and the Digital Personal Data Protection Rules 2025 (DPDP Rules) are fully operational in May 2027. The framework presently does not establish a general requirement that all personal data be stored in India. It does, however, contain certain provisions capable of imposing restrictions for certain cross-border transfers17.
From a data localisation perspective, while these frameworks do not themselves mandate that all data be stored exclusively in India, they have an important effect on how regulated entities structure and operate their information systems. This is particularly relevant where information is shared with third-parties, processed through cross-border or group-wide technology arrangements, or stored using cloud-based infrastructure. In practice, these obligations operate alongside the insurance-specific regulatory framework and require regulated entities to ensure, amongst other things, that appropriate system architectures and backup arrangements are implemented, notice and consent requirements are complied with where personal data is involved, and the requisite technical and organisational safeguards are maintained.
Conclusion
Data localisation for Insurers, Reinsurers, and insurance intermediaries is not governed by a single, standalone requirement. Rather, it emerges from the interaction of multiple legal and regulatory frameworks, including insurance-specific localisation mandates applicable to particular categories of information, cybersecurity requirements, India's data protection framework, and broader company law obligations. The practical implication is that regulated entities must adopt a holistic approach to compliance, mapping the types of information they collect, the manner in which such information is stored and processed, and the technology environments through which it flows, in order to assess compliance with the applicable regulatory requirements.
More broadly, data localisation is not unique to the IRDAI regulatory framework. Comparable requirements have also emerged for Insurers operating from GIFT City under the regulatory purview of the International Financial Services Centres Authority18 (IFSCA). Similar localisation mandates are also found in other segments of the financial services sector, including the Reserve Bank of India's requirement for payment system data to be stored in India19. Viewed in this context, we believe that the norms localising certain insurance sector data form part of a broader regulatory trend towards ensuring that information remains accessible within India's jurisdiction for effective oversight and regulatory control. The regulatory landscape is likely to continue evolving in this regard.
Footnotes
1. Section 14 of the Insurance Act (as amended).
2. Sections 14A, 14B and 14C of the Insurance Act, which respectively address processing of policyholder information, accuracy and security of policyholder information, and confidentiality of policyholder information.
3. R9 of the IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regulations 2025 (Information Regulations).
4. ¶12(3)(ii), Part III under Schedule III of the IRDAI (Actuarial, Finance, and Investment Functions of Insurers) Regulations 2024 (as amended), read with Section II under Chapter 3 of the IRDAI “Master Circular on Actuarial, Finance and Investment Functions of Insurers” of 17 May 2024.
5. ¶14(a)(x) of the IRDAI’s “Guidelines on Insurance e-commerce” of 9 March 2017.
6. IRDAI’s circular on “Clarification on maintenance of records by Foreign Reinsurer's Branches and Lloyd's India under the IRDAI (Maintenance of Information by the Regulated Entities and Sharing of Information by the Authority) Regulations, 2025” of 22 July 2025.
7. R14 of the Information Regulations.
9. R15 of the Information Regulations.
9. R16 of the Information Regulations.
10. R51 and R53 of Schedule III to the IRDAI (Protection of Policyholders' Interests, Operations and Allied Matters of Insurers) Regulations 2024.
11. Policy 2.1 of the Cyber Security Guidelines.
12. Policy 2.14 of the Cyber Security Guidelines.
13. Policy 2.19 of the Cyber Security Guidelines.
14. Policy 2.16 of the Cyber Security Guidelines. See also Direction (iv) of the CERT-In Directions of 28 April 2022, which requires service providers, intermediaries, data centres, body corporates and Government organisations to enable logs of their ICT systems, retain them securely for a rolling period of 180 days and maintain them within Indian jurisdiction.
15. Section 128 of the Companies Act 2013, read with the Companies (Accounts) Rules 2014 (as amended).
16. Please note that the Press Note dated 24 August 2011 issued by the Department of Information Technology clarified that an Indian body corporate providing collection/storage/handling services under a contractual obligation to another legal entity in or outside India is not subject to some of these requirements.
17. Section 16 of the Digital Personal Data Protection Act 2023 and Rules 13(4) and 15 of the Digital Personal Data Protection Rules 2025. These provisions should be read subject to any notification or order necessary for their operation in the future.
18. R4 of the IFSCA (Maintenance of Insurance Records and Submission of Requisite Information for Investigation and Inspection) Regulations 2022.
19. RBI Circular on “Storage of Payment System Data” of 6 April 2018.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
