Manu Shukla

Posted on Jul 20 • Originally published at ecorpit.com

Insurance app development in India: 9 IRDAI rules that shape your 2026 build

#insurtech

Insurance app development in India: 9 IRDAI rules that shape your 2026 build

Summary. In April 2026 the Insurance Regulatory and Development Authority of India gave insurers selling on digital platforms 15 days to self-assess against the Central Consumer Protection Authority's dark pattern guidelines of 30 November 2023, and one month to submit a remediation plan where they found gaps. On 2 July 2026 IRDAI escalated: it commissioned the Institute of Public Auditors of India to define and track insurers' use of dark patterns over 9 months. The trigger was a LocalCircles survey of more than 87,000 insurance customers across 341 districts, in which 85% said they were forced to share excessive personal data, up from 57% over 24 months, and 80% reported difficulty cancelling a policy, up from 61%.

Separately, IRDAI's cyber provisions introduced on 24 March 2025 put hard engineering constraints on any insurance application: notify IRDAI and CERT-In within 6 hours of a cyber incident, retain ICT and application logs for a rolling 180 days, and synchronise every system clock to India's official NTP source.

None of that is a legal footnote. Each item lands as a requirement on your architecture, your onboarding flow and your logging stack. This guide covers the nine that change what you build, and where teams usually get them wrong.

Why the regulator stopped trusting self-declarations

The enforcement history explains the shift.

CCPA-led action against dark patterns has leaned on platforms auditing themselves. After e-commerce platforms self-audited under a CCPA advisory, an independent review found dark patterns on 21 of the 26 platforms that had declared compliance. Insurance went the same way. IRDAI Chairman Ajay Seth, speaking at a Life Insurance Council event, described the response to its April directive: "Almost all have said they don't have dark patterns." IRDAI then commissioned an outside auditor instead.

Seth also named a specific pattern that most insurance product teams will recognise in their own funnel: making a customer hand over personal information before showing a quote. That practice sits across two frameworks at once. The CCPA guidelines treat coerced data-sharing as a dark pattern, while the Digital Personal Data Protection Act 2023 requires consent to be free, informed and specific. A quote flow gated behind a phone number and a marketing opt-in strains both.

The direction of travel is sectoral. The Reserve Bank of India has banned dark patterns in banks' digital interfaces from January 2027, and MediaNama reported an estimate that online marketplaces in India generate up to ₹28,000 crore a year from dark patterns across categories. Insurance regulators are no longer waiting for the consumer regulator to act on their sector.

The 9 rules, and what each one costs you in build time

Requirement	What it means inside the app	Where builds usually break
6-hour incident notification	Detection and escalation path that can produce a filing to IRDAI and CERT-In within 6 hours	Alerting exists but nobody owns the clock; no pre-drafted notification template
180-day log retention	Rolling 180 days of ICT and application logs, end to end	Logs rotate at 30 days by default, or app-tier logs are kept but gateway logs are not
NTP time synchronisation	All systems aligned to India's official Network Time Protocol source	Containers inherit host time; multi-region deployments drift and break forensics
Cyber crisis management plan	A structured, tested response mechanism, not a document	Plan exists on paper, never rehearsed against the 6-hour clock
Pre-empanelled forensic experts	Forensic partner contracted before an incident, not after	Procurement starts on day one of the breach and burns the response window
Separation of duties	The party identifying cyber risk cannot be the party investigating it	Same vendor does the VAPT and the incident investigation
Board reporting	Compliance status reported to the Board, minutes submitted to IRDAI	Engineering has the evidence, nobody formats it for board consumption
Dark pattern self-assessment	Quote, checkout, renewal and cancellation flows audited against the CCPA list	Cancellation is treated as a support ticket, not a product flow
DPDP-grade consent	Consent that is free, informed and specific, separable from the transaction	Marketing consent bundled into the same checkbox as policy servicing

The last two rows are where most insurance apps actually fail, and they are product problems rather than security problems.

The dark patterns that matter in an insurance funnel

The CCPA's 2023 guidelines list 13 dark patterns. Three map directly onto how insurance is sold.

Forced action. Compelling a user to share personal data to access a product. This is the wall of personal information Seth described, and in an insurance app it is almost always the quote form. If a term plan premium cannot be seen without a mobile number, that is the pattern.

Basket sneaking. Adding charges or products at checkout without consent. In insurance this shows up as an add-on rider pre-ticked, or a hospital cash benefit that appears in the premium breakdown without an explicit opt-in.

False urgency. Manufacturing scarcity or time pressure. A countdown on a premium quote that resets when you reload it is the textbook version.

Two more findings from the LocalCircles survey point at flows that are not usually thought of as design at all. 90% of respondents faced persistent calls, SMS or emails including after they tried to cancel, and 82% found discrepancies between advertised and actual pricing or terms. The first is a consent-revocation and suppression-list problem in your CRM. The second is a content and pricing-consistency problem between your marketing pages and your quote engine.

Build the cancellation journey as a first-class product flow with the same design attention as onboarding. It is the single flow the regulator's own survey data flags hardest, and it is the one most teams push into a call centre.

Designing the quote flow so it survives an audit

The practical fix is not complicated, but it inverts the usual growth-team instinct.

Show an indicative premium before asking for identity. Age band, cover amount and city are enough for an indicative quote on most products. Collect the mobile number when the customer chooses to proceed, not to see a number.

Separate the consents. Policy servicing communication and marketing communication are different purposes under the DPDP Act, and bundling them into one checkbox fails the "specific" test. Two checkboxes, neither pre-ticked.

Make withdrawal as easy as granting. If a customer can opt into marketing in one tap in the app, they need to be able to opt out in one tap in the app, and that withdrawal must propagate to every downstream system that can trigger an SMS.

Keep pricing consistent across surfaces. If the advertised premium on a landing page differs from the checkout premium, the reason needs to be visible before checkout, not after.

Log consent state changes with timestamps. This is where the 180-day retention requirement and the consent requirement meet: when a customer disputes a marketing call, the defence is a timestamped consent and withdrawal history, and that history has to still exist.

For teams working through the consent-management side of this in depth, our notes on the DPDP consent manager framework and readiness in India and the broader DPDP engineering playbook for Indian startups cover the data model this needs.

The engineering constraints, in order of lead time

Some of these take an afternoon. Some take a quarter. Sequence them accordingly.

Time synchronisation is the quick win. Point every host, container and managed service at India's official NTP source and verify drift. It takes hours and it is a precondition for everything forensic. Without consistent clocks, a 6-hour incident timeline cannot be reconstructed across services.

Log retention is a cost decision disguised as a config change. Moving from a 30-day default to a rolling 180 days across ICT and application logs multiplies storage. Do it deliberately: hot storage for the recent window, cheaper archive tiers for the tail, with the retrieval path tested rather than assumed. An archive you cannot read inside the response window is not retention.

The 6-hour clock is an organisational build, not a technical one. The engineering part is detection and a paging path. The hard part is a named owner, a pre-drafted notification, and a rehearsal. Run the drill before you need it.

Forensic empanelment and separation of duties are procurement work. Contract the forensic partner in advance, and make sure it is not the same firm running your vulnerability assessments. Starting procurement during an incident spends the window you were given to respond.

Teams building the testing discipline around this will find our QA and test automation service notes relevant, since consent-state and cancellation flows are exactly the paths that regression suites tend not to cover.

One authoritative service per question

The compliance work becomes tractable only if your architecture can answer three questions from one place each.

What did this customer consent to, and when? What is the current price of this product on every surface we publish it? What is the status of this policy right now? If each of those has one authoritative service, every rule above reduces to a query. If the answers live partly in a mobile client, partly in a CRM and partly in a spreadsheet, each rule becomes a project.

This matters beyond compliance. IRDAI's regulated perimeter explicitly includes web aggregators and intermediaries, which means product data, pricing and policy servicing already have to be consumable by parties other than your own app. Teams that treat the mobile app as the system of record rather than as one client of well-specified services pay for that decision twice: once during a compliance review and again during any integration.

Nine separate rules all end up asking the same thing. What did this customer agree to, when, and can you prove it?

What good looks like

A digital insurance product that would survive the current audit environment has a small number of properties.

Quotes visible without identity. Consents separated by purpose and never pre-ticked. Cancellation available in the app in the same number of steps as purchase. A suppression list that actually stops communication within a defined window of withdrawal. Clocks synchronised, logs retained for 180 rolling days with a tested retrieval path, and an incident owner who has rehearsed the 6-hour filing.

None of that is exotic engineering. It is ordinary discipline applied to flows that growth teams have historically been allowed to optimise without constraint. The regulator has now put a constraint on them.

India-specific considerations

Three things distinguish this from a generic fintech build.

The regulated perimeter is wide. IRDAI's requirements reach insurers, foreign reinsurance branches and intermediaries including brokers, corporate agents, web aggregators, third-party administrators and insurance repositories. If you are building a web aggregator rather than an insurer, you are inside the perimeter, not outside it.

The two frameworks interact. The CCPA dark pattern guidelines and the DPDP Act 2023 both bear on the same quote flow through different mechanisms, one on manipulation of choice and one on the validity of consent. A design that satisfies one can still fail the other, so review the flow against both rather than sequentially.

The audit posture has changed. With an independent auditor now tracking the sector for 9 months, a self-declaration is no longer the end of the exercise. Teams that documented compliance in April 2026 should expect to be measured against observed behaviour rather than the filing.

Related reading: our DPDP-ready app development notes and the fintech app development guide for India cover adjacent regulated-build patterns, and the accessibility audit and remediation guide is worth reading alongside this, since remediating a manipulative flow and remediating an inaccessible one touch the same screens.

FAQ

What exactly did IRDAI require in April 2026?

IRDAI directed insurers offering products on digital platforms to comply with the Central Consumer Protection Authority's dark pattern guidelines, carry out a self-assessment of their compliance status within 15 days, and submit an action plan with timelines for removing dark patterns within one month where gaps were found.

Why did IRDAI commission an independent study?

Because the self-declarations were not credible. IRDAI Chairman Ajay Seth noted that almost all insurers reported having no dark patterns, so IRDAI engaged the Institute of Public Auditors of India to define and track actual usage across a nine-month study announced in July 2026.

Which dark patterns apply most to insurance apps?

Three of the 13 patterns in the CCPA's 2023 guidelines map directly onto insurance selling: forced action, meaning compelling data-sharing to see a product; basket sneaking, meaning adding riders or charges at checkout without consent; and false urgency, meaning manufactured scarcity or countdown pressure on a quote.

How fast must an insurance company report a cyber incident?

Within six hours of identification, to both IRDAI and the Indian Computer Emergency Response Team. Meeting that window is an organisational capability rather than a purely technical one: it needs a named owner, a rehearsed escalation path and a pre-drafted notification ready before any incident occurs.

How long do insurance application logs need to be kept?

A rolling period of 180 days for ICT and application log data, with end-to-end monitoring across systems. Most default logging configurations retain far less, so this usually means a storage tiering decision plus a tested retrieval path rather than a single configuration change.

Does the DPDP Act change how insurance consent works?

Yes. The Digital Personal Data Protection Act 2023 requires consent to be free, informed and specific. Bundling marketing consent with policy servicing consent in a single pre-ticked checkbox fails that test, and a quote flow that demands personal data before showing a price strains the purpose-limitation principle.

Do these rules apply to web aggregators and brokers?

Yes. IRDAI's requirements extend across insurers, foreign reinsurance branches and intermediaries including brokers, corporate agents, web aggregators, third-party administrators and insurance repositories. Building a comparison or aggregation product rather than underwriting risk does not put you outside the regulated perimeter for either the cyber obligations or the dark pattern review.

What did the LocalCircles survey actually find?

It surveyed more than 87,000 insurance customers across 341 districts. 85% said insurers forced them to share excessive personal data, up from 57% over 24 months; 80% reported difficulty cancelling policies, up from 61%; 90% faced persistent calls, SMS or emails; and 82% found discrepancies between advertised and actual pricing.

How eCorpIT can help

eCorpIT is a senior-led, multi-disciplinary engineering organisation in Gurugram, founded in 2021 and assessed at CMMI Level 5, that builds regulated digital products for Indian financial services. For insurance clients we review quote, checkout, renewal and cancellation journeys against the CCPA dark pattern list, design consent and withdrawal models aligned with Digital Personal Data Protection Act 2023 requirements, and set up the logging, time-synchronisation and incident-response foundations that IRDAI's cyber provisions assume. Engagements typically start with a two to three week flow and architecture review that produces a prioritised remediation plan your board can act on. If you are building or remediating an insurance app in India, talk to us.