REGULATION OF CYBERSECURITY IN INSURANCE SYSTEMS: LEGAL FRAMEWORK AND JUDICIAL PRECEDENTS

1. INTRODUCTION

Cybersecurity in insurance systems concerns the legal and technical measures used to protect policyholder information, insurance databases, digital claims platforms, payment systems, underwriting algorithms, and online policy-management services against unauthorised access, cyberattacks, fraud, and data breaches.

Insurance companies process sensitive information, including medical histories, financial records, identity documents, nominee details, and claims information. A cybersecurity failure may expose customers to identity theft, financial loss, discrimination, and misuse of personal data. It may also disrupt insurance operations and undermine public confidence in the insurance sector.

In India, insurance cybersecurity is governed by sector-specific requirements, information-technology legislation, data-protection obligations, and judicial principles concerning privacy, confidentiality, and accountability. The principal objective is to ensure that insurers and intermediaries maintain appropriate security controls throughout the collection, storage, processing, and transfer of policyholder information.

2. LEGAL AND REGULATORY FRAMEWORK

A. INSURANCE ACT, 1938, AND IRDA ACT, 1999

The Insurance Act, 1938, establishes the general statutory framework for insurance business in India. The Insurance Regulatory and Development Authority of India (IRDAI) exercises regulatory and supervisory powers under the Insurance Regulatory and Development Authority Act, 1999. Section 14 of the IRDA Act empowers IRDAI to regulate, promote, and ensure the orderly development of insurance and reinsurance business and to protect policyholders' interests.

B. IRDAI INFORMATION AND CYBER SECURITY GUIDELINES

IRDAI issued the Information and Cyber Security Guidelines, 2023, on 24 April 2023. They extended cybersecurity governance requirements across insurers and specified insurance-sector entities, including intermediaries and the Insurance Information Bureau of India. The guidelines address cybersecurity governance, risk management, security controls, audits, incident management, and protection of information assets. <Cite refs={["turn475478search24","turn475478search5"]}/>

The 2023 framework is important historically, but compliance assessments must also account for the revised IRDAI Information and Cyber Security Guidelines, 2026, issued on 6 April 2026. Insurers should consult the operative 2026 instrument and its implementation requirements rather than relying exclusively on superseded provisions.

C. INFORMATION TECHNOLOGY ACT, 2000

Section 43 addresses specified unauthorised acts involving computer systems and data. Section 43A historically provided compensation for failure by a body corporate to maintain reasonable security practices in handling sensitive personal data, subject to its statutory conditions and the applicable legal framework. Section 66 addresses specified computer-related acts committed dishonestly or fraudulently, while Sections 72 and 72A concern particular forms of unauthorised disclosure and breach of lawful contractual confidentiality.

D. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The Act establishes a framework for processing digital personal data, including obligations concerning lawful processing, security safeguards, breach-related notifications, and the rights and duties specified by the legislation. Its applicability and commencement must be assessed against the relevant notifications and transitional arrangements in force at the material time. Insurers should map their obligations under this Act alongside applicable IRDAI requirements.

E. CERT-IN DIRECTIONS

The Indian Computer Emergency Response Team (CERT-In) issued directions on 28 April 2022 under Section 70B of the Information Technology Act. Covered entities must comply with applicable incident-reporting, record-retention, and related requirements. The directions generally prescribe reporting of specified cyber incidents within six hours of noticing them or being informed of them, subject to the directions' scope and terms.

3. PRINCIPAL CYBERSECURITY OBLIGATIONS

A. GOVERNANCE AND RISK ASSESSMENT

Insurers should establish board-level oversight, assign cybersecurity responsibilities, maintain an appropriate information-security function, and periodically assess threats to critical systems.

B. TECHNICAL SAFEGUARDS

Appropriate measures include multifactor authentication, encryption, access restrictions, secure backups, network monitoring, vulnerability management, penetration testing, and secure software development.

C. THIRD-PARTY AND CLOUD SECURITY

Insurers should assess the security of brokers, third-party administrators, technology vendors, cloud providers, and other entities handling policyholder information. Contracts should address confidentiality, access controls, incident reporting, audit rights, and secure termination of services.

D. INCIDENT RESPONSE

A documented incident-response plan should establish procedures for detection, containment, investigation, recovery, evidence preservation, and legally required notifications. Organisations should periodically test disaster-recovery arrangements and business continuity.

E. POLICYHOLDER PROTECTION

Insurers should minimise unnecessary data collection, restrict access to sensitive records, investigate suspected fraud, and provide accurate communications when incidents affect customers. Cybersecurity measures must also preserve legitimate access to insurance services and claims processing.4. IMPORTANT CASE LAWS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Relevance: Analogous constitutional authority on privacy and data protection. The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional freedoms. The judgment establishes that intrusions into privacy must satisfy constitutional requirements of legality, legitimate purpose, and proportionality. For insurers, this supports careful handling of health records, financial information, identity data, and policyholder databases. It is not a direct insurance cybersecurity ruling.

2. Shreya Singhal v. Union of India (2015) 5 SCC 1

Relevance: Analogous authority on internet regulation and intermediary liability. The Supreme Court struck down Section 66A of the Information Technology Act, 2000, and considered intermediary liability under Section 79. The judgment is relevant to understanding the legal boundaries of online regulation and intermediary responsibilities. Its application to an insurance platform depends on the platform's role and the specific statutory provisions involved.

3. Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473

Relevance: Directly relevant authority on electronic evidence, but not insurance cybersecurity. The Supreme Court established important requirements for admitting secondary electronic evidence under Section 65B of the Indian Evidence Act, 1872. In cybercrime investigations and insurance-fraud disputes, digital logs, emails, electronic claims records, and system-generated reports may be important evidence. The applicable evidentiary framework must now also be assessed under the Bharatiya Sakshya Adhiniyam, 2023, which replaced the former Evidence Act.

4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1

Relevance: Analogous authority on electronic records and forensic evidence. The Supreme Court reaffirmed the importance of statutory certification requirements for electronic records under the former Evidence Act. For insurers, this highlights the need to preserve system logs, access records, transaction histories, and forensic copies in a manner that supports authenticity and admissibility. The precise evidentiary requirements depend on the law applicable to the proceeding. <Cite refs={["turn221023search24","turn221023search25"]}/>

5. District Registrar and Collector v. Canara Bank (2005) 1 SCC 496

Relevance: Analogous authority on confidentiality and informational privacy. The Supreme Court considered the privacy implications of statutory access to private documents held by financial institutions. The judgment is relevant by analogy because insurers maintain confidential financial, medical, and contractual records. It supports the principle that access to private records must rest on lawful authority and comply with applicable legal safeguards.

6. People's Union for Civil Liberties v. Union of India (1997) 1 SCC 301

Relevance: Analogous authority on privacy and safeguards against intrusive access. The Supreme Court examined telephone interception and emphasised procedural safeguards against arbitrary interference with privacy. Although the case did not concern insurance databases, its reasoning is relevant when assessing access to communications, customer records, and electronic information by public authorities.

LEGAL POSITION: These judgments provide constitutional, evidentiary, and privacy principles relevant to cybersecurity governance. They should not be represented as direct Supreme Court rulings imposing a particular cybersecurity standard on insurers. Sector-specific obligations principally arise from applicable IRDAI instruments and legislation.

5. LIABILITY AND ENFORCEMENT

Cybersecurity failures may result in regulatory action, contractual disputes, compensation claims, or criminal proceedings, depending on the facts and applicable law. Under Section 43 of the Information Technology Act, specified unauthorised computer-related acts may attract compensation liability. Section 66 applies where the statutory elements of dishonest or fraudulent conduct are established. Data-protection and breach-notification consequences depend on the operative statutory provisions.

IRDAI may take regulatory action where an insurer or covered intermediary violates applicable requirements. An affected policyholder may pursue appropriate remedies through the relevant grievance mechanism, insurance ombudsman where jurisdictional requirements are satisfied, consumer commission where applicable, or competent court.

A cyber incident does not automatically establish negligence or entitle every affected person to compensation. Liability depends on the governing law, evidence, causation, loss, and applicable procedural requirements.

6. PRACTICAL COMPLIANCE MEASURES

Insurance organisations should implement the following measures:

Maintain a documented cybersecurity governance framework aligned with the operative IRDAI guidelines.

Conduct periodic security-risk assessments, vulnerability testing, and independent audits.

Apply multifactor authentication, encryption, least-privilege access, and secure backup procedures.

Review the cybersecurity arrangements of brokers, third-party administrators, cloud providers, and other vendors.

Establish incident-response procedures, including compliance with applicable CERT-In and data-protection reporting requirements.

Preserve electronic evidence with appropriate access controls, integrity checks, timestamps, and chain-of-custody documentation.

Train employees to recognise phishing, social engineering, credential theft, and fraudulent claims activity.

Test business-continuity and disaster-recovery plans and maintain procedures for communicating with affected policyholders.

7. CONCLUSION

Cybersecurity regulation in insurance systems is essential to protecting policyholders, preserving the integrity of claims processing, and maintaining confidence in digital insurance services. India's framework combines IRDAI supervision, information-technology legislation, data-protection obligations, and legal principles governing privacy and electronic evidence.

The 2026 IRDAI cybersecurity framework must be considered when determining current sector-specific compliance obligations, alongside applicable statutory requirements. The judicial precedents discussed above provide important supporting principles, although most are analogous rather than direct insurance cybersecurity authorities. Effective compliance ultimately requires risk-based security controls, timely incident response, accountable governance, and demonstrable protection of policyholder information throughout the insurance lifecycle.