#IRDAI Just Made DPDP Act Data Minimisation Enforceable in 2026 — Without Using the DPDP Act

The first Indian regulator to tell a whole industry it may no longer demand a phone number before showing a price is not the Data Protection Board. It is the insurance regulator, and it did so on 23 September under the Consumer Protection Act, 2019 — roughly twenty months before DPDP Act data minimisation becomes legally enforceable in May 2027.

The market understood the message faster than most compliance teams did. PB Fintech, which owns Policybazaar, closed 24 September down about 36% at ₹1,207.20 — its worst single session since listing, erasing roughly ₹31,000 crore of equity value. Turtlemint hit its 20% lower circuit. The trigger was a consultation paper, not a regulation — and it is open for comment until 25 October 2026.

#What IRDAI Actually Proposed

The paper is titled "Recalibrating Economics of Insurance Distribution – Part 1: Distribution Reforms." Most of its length deals with money: cutting life insurers' expense-of-management ceiling to 15% of gross direct premium within two years and 12.5% within five, bringing general insurers down from 30% to 20% over five years, and restructuring commissions segment by segment. That is what moved the stocks.

The provision that matters for privacy practitioners is shorter and easier to miss. IRDAI defines dark patterns as "any practices or deceptive design patterns using user interface or user experience interactions on any platform" that "subvert or impair consumer autonomy, decision making or choice" — then applies that definition to a practice it says is "often seen on the websites of most insurers and distributors": requiring a consumer to submit personal information before they can see product features and pricing.

The proposed rule, as MediaNama reported it, is that consumers must be able to reach information sheets, FAQs, brochures, premium rates and performance data without providing a name, phone number, email address or any identification. IRDAI's framing is blunt: "Access to information should not be used as a lead generation opportunity."

The regulator also proposes to track dark patterns actively and publish what it finds — reputational enforcement rather than penalty-led enforcement, which is a meaningful choice given how thinly the Data Protection Board is currently staffed.

#Why This Is DPDP Act Data Minimisation in Everything but Name

Strip away the insurance vocabulary and IRDAI has described a textbook purpose-limitation failure.

Section 6(1) of the DPDP Act requires that consent be "free, specific, informed, unconditional and unambiguous," given through a clear affirmative action, and — the operative clause here — "limited to such personal data as is necessary for such specified purpose." That last phrase is where DPDP Act data minimisation lives. A data fiduciary must define a lawful purpose and then collect only what that purpose actually requires.

Apply that test to a premium quote. The specified purpose is showing a consumer what a policy costs. Age, pin code, sum assured and smoking status are genuinely necessary to price risk. A mobile number is not — it does not enter the actuarial calculation at any point. It is collected because it has independent commercial value as a lead, which is a different purpose from the one the consumer was presented with.

That makes the demand fail Section 6(1) twice over. The data collected exceeds what the specified purpose requires, and the consent is not "unconditional" when the price is withheld until the number is surrendered. Rule 3 of the DPDP Rules, 2025 sharpens the point further: a notice must carry an itemised description of the personal data being collected and the specific purpose for each item, presented standalone and understandable independent of any other document. An itemised notice forces exactly the question insurers have avoided — which line item on this form is doing actuarial work, and which is feeding a telecalling queue?

IRDAI reached the same conclusion without citing Section 6 at all. It got there through the Central Consumer Protection Authority's Guidelines for Prevention and Regulation of Dark Patterns, 2023, issued on 30 November 2023 under the Consumer Protection Act, 2019, which list thirteen specified dark patterns including forced action and interface interference.

#The Same Week, the CCPA Did It to Marketing Consent

IRDAI was not acting alone, and the coincidence of timing is the real story.

In the same week, the Central Consumer Protection Authority circulated draft Guidelines for Prevention and Regulation of Pesky, Promotional and Unsolicited Commercial Communications, 2026, framed under Section 18(2) of the Consumer Protection Act, 2019. As reported by MediaNama, the draft would require explicit consent for each specific brand and product before promotional contact, obtained through the telecom Digital Consent Acquisition facility or an equivalent verifiable mechanism. It would impose a cooling-off period after opt-out — 45, 60 or 90 days, still undecided — during which a business may not seek fresh consent. It extends past SMS and voice to OTT messaging apps, RCS, push notifications and social media, and it mandates audible or visible disclosure whenever a promotional voice or text is AI-generated.

Read Section 6 of the DPDP Act next to that draft and the overlap is near-total. Consent must be specific rather than bundled. Withdrawal must be as easy as giving. Purpose must be stated up front. The CCPA is legislating DPDP consent standards through consumer law while the DPDP consent standards themselves sit eighteen months from enforceability.

Industry has noticed the cost. FISME Secretary General Anil Bhardwaj called the requirements "fundamentally disproportionate, impractical and detached from the realities of how small businesses acquire and engage with customers."

#The Enforcement Gap: Why DPDP Act Data Minimisation Bites Before May 2027

There is a comfortable assumption in a lot of Indian boardrooms: the DPDP Rules were notified on 13 November 2025, consent manager registration opens on 13 November 2026, and the substantive obligations — notice, consent, breach reporting, data principal rights, Significant Data Fiduciary duties — only bite on 13 May 2027. Budget accordingly, start late, absorb the risk.

The two September drafts show why that arithmetic is wrong. The DPDP Act layers on top of sectoral regulation; it does not displace it. RBI, SEBI, IRDAI, TRAI and PFRDA have each already folded data-governance expectations into their own cybersecurity and conduct directions — IRDAI's 2026 Cyber Security Guidelines explicitly require DPDP Act compliance from regulated entities — and those directions are enforceable now, through licensing conditions and supervisory action that need no Data Protection Board sitting to give them effect.

That matters because the Board remains the weak link. It was constituted on 13 November 2025, yet MeitY's appointment process for the Chairperson and Members has run since May 2026 without a notification, and no Significant Data Fiduciary list has issued. Consumer and sectoral regulators, by contrast, are fully staffed and already active — the CCPA issued a self-audit advisory to e-commerce platforms on dark patterns in June 2025 and has kept up enforcement since.

The practical consequence: the compliance question for a regulated Indian business in 2026 is no longer "when does the DPDP Act apply to me." It is "which of my regulators will reach my data practices first, and under which statute." For insurers and distributors, the answer arrived on 23 September. IRDAI's annual report for 2024-25 already recorded 26,667 complaints of mis-selling and unfair business practices, up nearly 14% year on year — a grievance base that makes a data-gating ban easy to justify on consumer-protection grounds alone.

#What Insurers and Distributors Should Do Before 25 October

The consultation closes on 25 October 2026 and the cost caps carry a five-year glide path, so nothing changes overnight. The design change does not need to wait for either.

Separate the information layer from the lead layer. Premium rates, brochures, information sheets, FAQs and performance data should be reachable with zero identifiers. If a field is not priced into the quote, it does not belong on the quote form. This is the single change that satisfies both the IRDAI proposal and Section 6(1), and it is a front-end task, not a legal one.

Audit every form field against a stated purpose. Rule 3's itemised-notice requirement is the right template even before it is enforceable. For each field, write down the specific purpose it serves. Fields that survive only as "useful for follow-up" are the ones that will fail both tests.

Re-paper the lead-sharing chain. Web aggregators routinely pass lead data back to participating insurers, who pass it on to licensed agents. Under the DPDP Act each hop needs a lawful basis traceable to the original consent, and under the CCPA draft each brand needs its own consent before it makes contact. Bundled "I agree to be contacted by partners" checkboxes do not survive either regime.

Model the CCPA cooling-off period now. A 90-day bar on re-seeking consent after opt-out has to be enforced in the CRM, not in a policy document. Most Indian marketing stacks cannot currently prove when consent was withdrawn, let alone suppress re-solicitation for a fixed window.

File a comment. A consultation paper with a live deadline is the cheapest point at which to shape a rule. The proportionality argument FISME is making on the CCPA draft is available to insurers on the IRDAI draft too — and it is far more persuasive filed before 25 October than litigated afterwards.

Teams mapping these obligations against the phased DPDP timeline will find our compliance resources useful, and the November 2026 registration framework is covered in detail in our consent manager guide.

#What It Means for Citizens

For an individual buying insurance in India, the proposal would end a specific and familiar indignity: entering a mobile number to see a premium and fielding calls about it for the next two years. The number leaks outward through aggregators, insurers, agents and, frequently, the open market for telecaller databases. More than 70% of Indian consumers report unwanted sales calls about loans and insurance.

The deeper shift is conceptual. Indian regulation has generally treated the surrender of personal data as the ordinary price of access — the thing you pay to see a price, read an article, download a brochure. IRDAI's paper says, for one sector, that this price may no longer be charged, because access to information is not a lead generation opportunity. That principle has always been latent in Section 6(1) of the DPDP Act. It just took a consumer regulator to say it out loud first.

#The Bottom Line

Two draft instruments issued in a single week by two consumer regulators have done more to make DPDP Act data minimisation operational than the eighteen months since the DPDP Rules were notified. Neither cites the DPDP Act as its source of power. Both would be enforceable well before 13 May 2027.

If your organisation's DPDP programme is built around that 2027 date, the September drafts are the signal to re-plan. The obligations are arriving early, through the side door, and your sectoral regulator is holding it open.

Mapping your consent flows against both the DPDP timeline and your sectoral regulator's requirements? Start with our compliance resources, and review the consent manager framework before the November 2026 registration window opens.

---

Sources: MediaNama on the IRDAI dark pattern proposal · Storyboard18 · BusinessToday on the market reaction · MediaNama on the CCPA draft guidelines · PIB on the Dark Patterns Guidelines, 2023 · S&R Associates on DPDP data minimisation · DPDP Rules 2025, Rule 3