Overview
ICICI Lombard is one of India’s leading private general insurers. Handling millions of policies involving sensitive personal data (health records, financial details, and KYC), the company faces high scrutiny under the DPDP Act 2023. Their 2026 ESG and Cyber Security updates indicate a proactive shift toward compliance, though the user-facing interface still mirrors older IT Act 2000 paradigms.
DPDP Readiness: Section-by-Section Analysis
Section 6 — Consent & Notice ⚠️
The policy currently relies on “deemed consent” or bundled acceptance. The phrase “By using this website… you hereby authorize us” is common throughout the document.
DPDP Requirement: Consent must be a “clear affirmative action” that is free, specific, informed, unconditional, and unambiguous.
Gap: Users cannot selectively consent to data processing for insurance underwriting while opting out of “customization” or “marketing” via the primary interface. The notice is not yet provided in multiple languages as suggested by Section 5.
Section 8 — Obligations of Data Fiduciary ✅
This is a major strength for ICICI Lombard. Their 2026 ESG Policy (Version 3) confirms:
- Implementation of a Board-approved Information & Cyber Security Policy.
- Regular independent audits based on ISO 27001:2022.
- A 24/7 Security Operations Centre (SOC).
Strength: They meet and likely exceed the “reasonable security safeguards” requirement to prevent personal data breaches.
Section 9 — Data Retention 🔴
The policy states: “We store this information for our records and to verify authenticity.”
DPDP Requirement: Data must be erased once the purpose for collection is fulfilled, or upon withdrawal of consent, unless a legal obligation (like IRDAI’s record-keeping rules) mandates retention.
Gap: There is no mention of automated erasure or “right to be forgotten” workflows. While insurance laws require long retention for claims (often 10+ years), the DPDP Act requires the fiduciary to define this period clearly and purge data thereafter.
Section 11 — Rights of Data Principal ⚠️
The policy allows for data correction and access but lacks the full suite of DPDP rights:
- Right to Nominate (Section 14): Missing. There is no mechanism for a user to nominate a person to manage their data rights in case of death or incapacity.
- Right of Erasure: Only partially addressed; the policy emphasizes storage for “records” over the user’s right to request deletion of non-essential data.
Section 12 — Right of Grievance Redressal ⚠️
ICICI Lombard has a sophisticated 3-step grievance process involving a Grievance Redressal Officer (GRO) and an Appellate Officer.
Gap: The process directs users to the Insurance Ombudsman or IRDAI Bima Bharosa. Under DPDP, a Data Principal must have an explicit path to escalate data privacy grievances to the Data Protection Board of India (DPB). The current policy fails to mention the DPB.
Section 16 — Cross-Border Data Transfer ⚠️
The policy mentions sharing information with “other ICICI Bank Group Companies” and “statutory bodies.”
Gap: Section 16 of the DPDP Act allows the Central Government to restrict transfers to certain countries (“Negative List”). The policy currently uses a blanket authorization that may not hold up once the government notifies restricted jurisdictions.
Risk Assessment
| Category | Risk Level | Compliance Gap |
|---|---|---|
| Consent Management | High | Lack of granular, itemized consent; “Take-it-or-leave-it” terms. |
| Data Principal Rights | Medium | No Right to Nominate or easy erasure mechanism. |
| Data Retention | Medium | Retention is indefinitely linked to “records” without clear expiry. |
| Security Safeguards | Low | Strong SOC, ISO 27001:2022, and regular auditing. |
| Regulatory Conflict | High | Tension between IRDAI’s retention mandates and DPDP’s erasure rights. |
Recommendation
ICICI Lombard should transition from its current “Terms of Use” style privacy policy to a Layered Notice format. This should include a “Consent Manager” interface that allows users to toggle specific data uses and provides a clear mechanism for Section 14 Nomination. While the technical backend is compliant, the legal framework requires an update to recognize the Data Protection Board as the primary authority for privacy-related disputes.