Irdai's insurance registry: What data will it link and who can access it?

From policy and claims records to intermediary and grievance data, Irdai's proposal sets out what the registry could connect and how access would be controlled

The Insurance Regulatory and Development Authority of India (Irdai) on Tuesday proposed a Public Insurance Registry (PIR) as a Digital Public Infrastructure (DPI) for the insurance sector.

 

The regulator said its consultation paper linked the proposal to the objectives of the Sabka Bima Sabki Raksha (Amendment of Insurance Laws) Act, 2025.

 

Irdai described PIR as a “population-scale, interoperable and non-exclusionary” digital infrastructure, which is intended to address information gaps across the insurance sector while allowing the underlying records to remain with the institutions that maintain them.

 

The consultation paper said PIR would use a shared system that lets different institutions exchange information using common standards, while keeping the data with the institutions that hold it.

 

What is the Public Insurance Registry?

The proposed PIR would act as a "common layer" through which authorised participants can discover, verify and exchange insurance information.

 

The registry is proposed to connect insurers, reinsurers, insurance intermediaries, policyholders, regulators, financial institutions, government departments and research institutions.

What data will PIR connect?

It would link several types of insurance information, including product details, policy and claims records, intermediary information, grievances and policyholder identity.

 

This could include information on insurance coverage, premiums, benefits, claims, complaints, insurer and intermediary details, and unclaimed amounts. The registry could also use anonymised data for purposes such as analysing protection gaps, insurance losses and industry trends.

 

PIR could also connect with external databases for specific purposes, including information related to KYC, vehicles, health, mortality, weather and disasters.

 

Notably, PIR is not proposed as a single database containing all this information. The underlying records would remain with the institutions that hold them. PIR would provide controlled access to the information required for a particular purpose.

 

For example, an insurer could access a customer's relevant insurance and claims history from another insurer with the customer's consent, while detailed policy and claim documents would continue to remain with the source insurer.

How will the data remain with original institutions?

PIR is proposed to follow a “source-system primacy” approach.

 

Under the framework, an insurer, government agency or another institution that already owns and maintains a record would continue to be its source of record. PIR would not replace that institution.

 

The paper proposed three broad ways in which information could be handled:

• Reference: PIR holds a lightweight reference to a record held by the source institution.
• Governed copy: Information needed for a genuine cross-insurer purpose can be held centrally under defined controls.
• Anonymised aggregate: Data can be aggregated where the purpose is analysis or sector-level insights rather than individual case handling.

PIR could also connect to external systems without copying their data. The consultation paper listed possible connections with the Central KYC Registry, Aadhaar authentication, vehicle-registration systems, health and mortality registries, weather and disaster databases and court case-management systems. Each source would continue to be the authoritative record-keeper for its own data.

What will make the systems interoperable?

The proposal relies on common standards rather than forcing all insurers to use the same technology platform.

 

It proposed common definitions, identifiers and data formats. Terms such as “claim”, “grievance”, “lapse” and “surrender” would need common meanings across insurers. Data exchanged through PIR would also carry information about its source, creation or update time and version.

 

For identity, the proposed approach combines strong identity anchors such as Aadhaar, PAN and CKYC with a probabilistic method based on demographic information where a strong anchor is unavailable. Identity records could carry different confidence levels, including a requirement for manual review.

 

Existing insurance records would not have to be standardised at once. New policies and policy events could follow PIR's standards from an agreed date, while existing records could be brought into the system progressively during renewals or other material events. Insurers could use a mapping layer to link their existing formats to PIR standards.

Who will be able to use PIR?

PIR Stakeholders Infogram

Who will get access to the data?

Not every user will have access to every piece of information. The proposed framework links access to the "purpose for which the data is being used".

 

Some information would be available to Irdai and other authorised bodies for regulatory or investigative purposes. Customers could access their own information, while insurers could access relevant customer data with consent. The framework also allows for anonymised and aggregated data to be used for industry analysis and research.

 

The paper proposed that consent-based access should be "specific, informed, revocable and auditable". Data needed for a particular purpose could also be fetched from the source institution instead of being stored centrally.

How will privacy be protected?

The proposed framework includes role-based access, purpose limitations, data masking and audit trails. It also said that commercially sensitive information, such as insurer-specific pricing, underwriting rules, and product strategies, would not be disclosed through cross-industry datasets.

 

PIR would have to comply with laws including the Digital Personal Data Protection Act, 2023, Aadhaar Act, 2016 and Information Technology Act, 2000.

What happens next?

The proposal is still at the consultation stage. Irdai has proposed a phased approach, with different use cases being taken up based on factors such as data availability, legal requirements, privacy safeguards and technology readiness.

 

For governance, the consultation paper proposed converting the Insurance Information Bureau (IIB) into a not-for-profit company wholly owned by Irdai, which would set up PIR under a separate regulatory framework.

 

Irdai has invited comments on the proposal, including its data architecture, identity framework, standards, privacy safeguards, governance and implementation. The deadline for the same is September 30.