(1) These Regulations may be called the Insurance Regulatory and Development Authority of India (Maintenance of Insurance Records) Regulations, 2015.

(2) They shall come into force from the date of their publication in the Official Gazette.

In these regulations, unless the context otherwise requires:

(a) Act means the Insurance Act, 1938 (4 of 1938) as amended from time to time;

(b) Authority means the Insurance Regulatory and Development Authority of India established under the provisions of sub-section 1 of Section 3 of the Insurance Regulatory and Development Authority Act, 1999;

(c) All words and expressions used herein and not defined but defined in the Act, or in the Insurance Regulatory and Development Authority Act, 1999 or in any Rules or Regulations made there under shall have the meanings respectively assigned to them in those Acts or Rules or Regulations.

(1) Every insurer shall maintain a record of every policy issued and a record of every claim made as per section 14(1)(a) and 14(1)(b) of the Act.

(2) Record of such policies and claims shall also be maintained in electronic form irrespective of maintenance in any other form.

(3)(a) Every Insurer shall ensure that the records referred in sub regulation (1) and (2) of regulation 3 shall be complete and accurate.

(b) The system of maintenance shall have necessary security features.

(4) Every Insurer shall provide access of records referred in sub regulation (1) and (2) of regulation 3 to the Authority for both onsite and offsite inspections.

(5) The manner and maintenance of the records referred in sub-regulation (1), (2) and (3) of regulation 3 shall be as per policy framed by the insurers and approved by their board.

(6) With regard to the maintenance of records in electronic form, the policy referred in sub-regulation (5) of regulation 3 shall inter alia include the following:

i. Processing and electronic maintenance of records,

ii. Privacy and security of policyholder and claim data,

iii. Handling Virus, Vulnerability issues,

iv. Security of Hardware and Software,

v. Backups, Disaster Recovery and Business Continuity and

vi. Data Archival.

(7) Such policy of the Board referred in sub-regulation (5) of regulation 3 shall also include a detailed plan to review the implementation of the maintenance and storage of records. Such review will be overseen by the Risk Management Committee of the Board of the Insurers.

(8) Every policy of the Board referred in sub-regulation (5) of regulation 3 shall be reviewed once in a year within 90 days from the expiry of the financial year.

(9) The records including those held in electronic mode, pertaining to all the policies issued and all claims made in India shall be held in data centres located and maintained in India only.

(10) Every insurer shall ensure that the records held are organized in such a manner as may be required for business use and easy retrieval so as to support policyholder service and compliance with the various laws, regulations, circulars, guidelines and such other regulatory framework as applicable from time to time.

(1) Every insurer shall within 90 days from the date of notification of these regulations, file with the Authority, their board approved policy on maintenance and storage of such records.

(2) Where such a Board approved policy is modified, the same shall be filed with the Authority, within 30 days from the date of such modification by the board.

(1) In order to remove any doubts or difficulties in application or interpretation of any of the provisions of these Regulations, the Chairperson of the Authority may issue appropriate clarifications or guidelines as deemed necessary.

1. IRDA, Noti. No. F.No. IRDAI/Reg/10/100/2015, dated August 12, 2015, published in the Gazette of India, Extra., Part III, Section 4, dated 20th August, 2015, pp. 3-4, No. 282.