Overview
Acko is a digital-first insurance provider. Because they handle everything from car insurance to health cover, they are a Data Fiduciary—a fancy legal term for the company that decides how and why your data is processed.
They handle the “crown jewels” of personal info: your health records, bank statements, and even your real-time location. If you’re a business owner, Acko’s policy is a masterclass in how not to bundle consent if you want to stay on the right side of the new law.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice 🔴
Acko uses a “take it or leave it” approach. If you use the app, they claim you’ve given “unequivocal consent.”
What the policy says: “BY SETTING UP YOUR ACKO ACCOUNT… YOU ARE CONSENTING TO COLLECTION, PROCESSING, STORAGE, USAGE AND SHARING AS PER THIS POLICY.”
What the law requires: Under the DPDP Act, consent must be specific and informed. You can’t just bunch everything into one big “I Agree” button.
The problem: You are the Data Principal (the person the data belongs to). You should be able to get insurance without necessarily agreeing to let them read your SMS for “financial profiling.” In the eyes of the DPDP Act, this bundled consent is likely invalid.
Section 7 — Certain Legitimate Uses ⚠️
The policy leans heavily on “applicable laws” (like IRDAI rules) to process data without extra permission.
What the policy says: “We and our Insurance Providers will continue to collect, use, process, and store your personal data as per the requirements under the applicable laws…”
What the law requires: Section 7 allows companies to process data for “legitimate uses” like fulfilling a legal mandate or a medical emergency.
The problem: While insurance laws require some data storage, Acko uses this as a blanket shield. They don’t clearly separate what they must keep by law versus what they want to keep for their own marketing.
Section 8 — Obligations of Data Fiduciary ⚠️
What the policy says: They mention using “third-party service providers” to perform KYC and manage the platform.
What the law requires: Acko is responsible for what their partners do. If their KYC vendor leaks your data, Acko is on the hook for the fine.
The problem: The policy gives Acko “sole discretion” to share data with affiliates. Under DPDP, they need to ensure these partners also follow strict security standards, but the policy is vague on how they audit these “group companies.”
Section 9 — Data Retention 🔴
This is a major red flag for any privacy-conscious person.
What the policy says: “Withdrawal of consent… will not diminish and/or affect our rights… to collect, use, process, and store your personal data.”
What the law requires: Section 9 says once the purpose is served (e.g., your policy expires and the legal waiting period ends), the data must be deleted.
The problem: Acko essentially says “we might keep it anyway if the law says so,” but they don’t give you a “Delete My Data” clock. As a user, you have no idea if your medical history stays on their servers for 5 years or 50.
Section 11 — Rights of Data Principal ⚠️
What the policy says: You can withdraw consent, but they warn they might stop providing services if you do.
What the law requires: You have the right to:
- Correct your data.
- Erase your data.
- Nominate someone to manage your data if you pass away (Section 14).
The problem: Acko’s policy doesn’t mention the Right to Nominate. If even a big player like Acko misses this, it shows how many startups are likely skipping these new mandatory rights.
Section 12 — Right of Grievance Redressal ⚠️
The problem: While they have a Grievance Officer, the policy (in this version) doesn’t mention the Data Protection Board of India.
What the law requires: If you aren’t happy with Acko’s response, the law gives you the right to complain to a government-appointed Board. If your policy doesn’t tell users about this, you’re not fully compliant.
Section 16 — Cross-Border Data Transfer ⚠️
What the policy says: “We may disclose your personal information to third parties (including any foreign third parties)…”
What the law requires: Data can only be sent to countries that the Indian government hasn’t “blacklisted.”
The problem: The policy is too broad. It doesn’t specify which countries or what protections are in place when your sensitive medical data leaves Indian shores.
Risk Assessment
| Category | Risk Level | Potential Impact |
|---|---|---|
| Consent Validity | 🔴 High | Fines for “bundled consent” which is no longer legal. |
| Intrusive Scraping | 🔴 High | Gmail/SMS access for “profiling” is hard to justify as “necessary.” |
| Data Retention | ⚠️ Medium | Legal friction over “perpetual” data storage claims. |
| Principal Rights | ⚠️ Medium | Failure to provide a nomination path is a Section 14 violation. |
Recommendations
- Unbundle the “Agree” button — Let users choose: “Yes to Insurance,” “No to SMS marketing.”
- Add a Deletion Schedule — Tell people exactly how many years you keep data after a policy ends (e.g., “10 years per IRDAI mandate”).
- Introduce Nomination — Add a simple form in the app where users can name a person to handle their data rights.
- Clean up “Affiliate” sharing — Don’t just say “we share with group companies.” Tell the user which ones and why.
- Update Grievance Paths — Explicitly mention the Data Protection Board as the final step for unhappy customers.