Insurance companies have been outsourcing for decades. Claims processing, policy administration, grievance handling, customer support, back-office work. All of it has moved to BPOs at some point. I have worked inside enough of these engagements, on both sides of the table, to have formed strong opinions about what works and what does not.

The place I see the industry get this most wrong is data privacy. Specifically, how insurance leaders think about privacy when they sign an outsourcing deal.

The question I hear in almost every procurement meeting is some version of: “if there is a data breach at the BPO, who takes the blame?” It is a fair question. But in my view, it is the wrong question. Asking it leads insurers to sign contracts that look safe on paper and are weak in practice.

The question most insurers ask (and why it is wrong)

Here is how the question usually gets asked in a procurement meeting. “If we outsource claims processing to this BPO and there is a breach, how do we make sure the BPO takes the blame and we do not?”

The assumption behind this question is that blame can be contracted away. If you write a strong indemnity clause, cap the BPO’s liability high enough, and ask them to carry cyber insurance, you have pushed the risk off your shoulders. You can sleep.

In my view, this is where most insurance leaders are wrong, and I have been inside enough post-breach reviews to be confident about it. You cannot contract blame away to a BPO. The regulator does not read your contract. The regulator looks at who the policyholder’s data belonged to, and that is you.

The right question, which I almost never hear in a procurement meeting, is this: what do we need to see and control at our BPO so that we can honestly tell a regulator we were doing our job?

That is a different question. It leads to different contract clauses. And it produces an outsourcing relationship that is both safer and more honest about what the BPO is actually doing with your policyholder’s data.

What DPDP Act 2023 actually says about outsourcing

India’s Digital Personal Data Protection Act, passed in 2023, is now the main privacy law for every Indian insurance company. It uses two terms that every insurance leader needs to understand.

A Data Fiduciary is the company that decides why and how personal data gets used. For an insurance company, that is you. If you are a large insurer, you may be classified as a Significant Data Fiduciary, which comes with extra duties like running privacy impact checks and getting audited.

A Data Processor is anyone handling data on behalf of a Data Fiduciary. Your BPO is a Data Processor. Under the Act, a Data Processor can only use the data in the way the Fiduciary tells them to. They are responsible for keeping it secure. But the Act is clear: the Fiduciary (that is you) does not get off the hook just because a Processor made the mistake.

What this means in practice for an insurer using a BPO:

• You are the one accountable to the Data Protection Board of India if something goes wrong
• You must notify the Board within 72 hours of discovering a breach
• You must have a Data Processing Agreement with every BPO handling your policyholder data
• You keep the right to audit how your BPO processes data
• You cannot pass the blame for a BPO’s breach to the BPO through contract language alone

The IRDAI Information and Cyber Security Guidelines, which govern cybersecurity at Indian insurers, go even further. They require your board to oversee outsourcing arrangements and to run periodic security checks on your outsourcing partners. The board, not the vendor manager.

What HIPAA actually says about outsourcing

For US health insurance, HIPAA is the main privacy law. Other laws stack on top of it. GLBA covers financial services. State laws like NY DFS Part 500, California’s CCPA and CPRA, and others, apply to different lines of business. The pattern is the same across all of them.

Under HIPAA, the insurance company holding patient health information is called a Covered Entity. The BPO processing that information on behalf of the insurer is called a Business Associate. The two are connected by a Business Associate Agreement or BAA. The rule is simple: no BAA, no sharing of patient health information. Full stop.

A BAA has to cover:

• What the BPO is allowed to do with the data
• How the BPO must protect it
• How quickly the BPO must notify the insurer of a breach
• The insurer’s right to audit and inspect
• What happens to the data when the contract ends

Here is what most procurement conversations miss. HIPAA holds the insurer accountable for what the BPO does, in a very specific way. The Office for Civil Rights, which enforces HIPAA, has gone after insurers when breaches happened at their BPOs. Specifically when the insurer did not check the BPO properly before signing them, or did not supervise them well enough afterward.

So the blame does not disappear when your BPO signs the BAA. The blame extends to cover whether you did your job in picking and watching your BPO.

State laws say the same thing in different words. The NAIC Insurance Data Security Model Law, now active in over 20 states, specifically requires insurers to check their third-party service providers and keep an eye on their security practices. Not just at signing. All the time.

The misconception at the heart of most BPO contracts

Here is the pattern I see in almost every outsourcing contract I review. There is a strong indemnity clause saying the BPO will cover any damages. The limit of the BPO’s liability is set at a big number. The BPO has cyber insurance for that amount. Everyone at the procurement meeting feels protected.

Then I ask different questions:

• When did your team last check how the BPO controls who has access to policyholder data?
• Who else is your BPO sharing your data with? When did you last review that list?
• How many hours (not days) does the BPO have to tell you about a breach?
• Does your contract allow the BPO to use policyholder data to train AI models? If not, how do you enforce that?
• When did you last run a joint incident response drill with the BPO?
• Which specific people at the BPO can access your policyholder data today?

In most meetings I have, the honest answers are: never, we are not sure, 24 hours but with lots of exceptions, the contract does not say, never, and we are not sure.

In my view, this is the trap. The contract makes the insurer feel safe while the actual operation is wide open. The paper is strong, the practice is weak. When a breach happens, which it does often enough across the industry to be a real worry, the insurer finds out that the indemnity clause is a small part of the story. The big part is what the regulator thinks about how closely the insurer was watching the BPO.

What good oversight actually looks like

The right way to think about your BPO is as an extension of your own operations, not as a vendor you have handed the risk to. In my experience, this changes six specific things about how the contract is written and how the relationship is run.

Specific access controls, not general ones. Do not accept language like “the BPO will maintain appropriate access controls.” Replace it with “the BPO’s access controls will be reviewed every quarter by the insurer’s security team, with named people doing the review and written findings.” The specifics are what matter.

Approval, not just notification. Most contracts allow the BPO to bring in sub-vendors as long as they notify you. In my view, this is a serious gap. The right structure is approval, where your security team reviews each sub-vendor before they ever touch your data.

Breach notice in hours, not days. Both DPDP and HIPAA have strict timelines for notifying regulators about a breach. If your contract gives the BPO 24 or 48 hours to tell you first, you are already set up to miss your own regulatory deadline. The right contract says 4 to 6 hours from the moment the BPO detects the breach, not from the moment they confirm it.

Audits that actually happen. Most contracts give you the right to audit the BPO. In most relationships I see, that right is never used. A right to audit that nobody exercises is worthless. The contract should say when the audit happens, who does it, and what cooperation the BPO owes.

AI and training data rules. Both DPDP and HIPAA raise questions about whether personal data can be used to train AI models. Most contracts I read say nothing on this. In 2026, with BPOs using more AI tools, that silence is itself a risk.

Data deletion at exit. When the contract ends, what happens to the data? Most contracts have words about this. Few have a way to actually confirm the data was deleted. The confirmation is where the exposure sits.

Our earlier piece on RBI compliance for bank outsourcing covers the same pattern in banking. The law is different. The principle is identical. The accountability stays with the regulated company.

A worked example: Northern Shield’s contract rewrite

(Northern Shield is a made-up name for a mid-sized Indian health insurer. The story is hypothetical. The pattern is not.)

A year into our work with Northern Shield, their Chief Information Security Officer flagged that their outsourcing contracts, including ours, were not strong enough for the DPDP Act. He was right. The contracts had been written in 2022 under the older privacy rules and had not been updated since.

The rewrite focused on five changes:

• The breach notice window shrank from 48 hours to 4 hours
• Sub-vendor approval replaced sub-vendor notification
• A quarterly joint review of access controls was written into the operating rhythm
• The contract explicitly banned using policyholder data for AI training unless the insurer wrote permission in advance
• The right to audit got teeth: a committed yearly audit with written findings shared with the insurer’s board

The work we did for them did not change. The oversight did. Northern Shield’s CISO told the board that the outsourcing relationship had moved from a known risk to a managed one. That is the shift I think most insurers need to make.

What this changes for insurers in 2026

The DPDP Act is now being enforced. India’s Data Protection Board is up and running. US state privacy laws are getting stricter. The NAIC Model Law keeps spreading to new states. In every direction, regulators are expecting more oversight of outsourcing partners, not less.

My view, having watched enforcement in both markets, is that 2026 is the year the gap between a strong contract and a weak operation will get tested in public. The insurers who still think of outsourcing as a way to transfer the risk will find themselves on the wrong side of enforcement actions where the regulator asks what oversight was in place. The indemnity clause will not help them.

The insurers who get ahead of this are the ones who treat their BPO like a part of their own operation, with full visibility. Not like a black box with a strong contract wrapped around it. That shift in thinking is the single most important change I would push any insurance leader reading this to make.

What this piece does not cover

Three things I have deliberately left out.

• Exact contract language. I am not a lawyer. The actual drafting of indemnity clauses, liability limits, and audit rights needs to be done by qualified privacy counsel in the right jurisdiction. The principles above should guide your brief to your lawyers, not replace them.
• Cross-border data transfer details. The DPDP Act’s rules on moving data across borders are still evolving through 2026. US state laws on offshore processing are tightening at different speeds. Both deserve case-specific treatment, which is outside the scope of this piece.
• AI and model training in depth. Whether and how BPOs can use insurer data to train AI models is a bigger topic than this piece can cover. Our companion piece on governance before AI touches a claim starts the conversation.

A 12-point BPO data privacy audit

If you want to run a quick check on your current outsourcing arrangements, these are the 12 questions I would start with. Each one you can answer yes to, with evidence, is 1 point. 9 and above is a reasonable position. Below 6 is a structural gap.

Legal and regulatory

1. Do you have a current Data Processing Agreement in place that reflects DPDP 2023 or current HIPAA rules?
2. Does the agreement clearly name the BPO as a Data Processor or Business Associate, not as an independent controller?
3. Do sub-vendors need your approval, not just a notification?

Oversight 4. Does your security team actually audit the BPO every year, with written findings? 5. Does your team review who at the BPO can access your data at least every quarter? 6. Do you run a joint incident response drill with the BPO at least once a year?

Breach notification 7. Does the contract require the BPO to tell you within 4 to 6 hours of detecting a breach? 8. Does the clock start from detection, not from confirmation? 9. Does your own team have a tested runbook for your 72-hour DPDP or state-level breach notification?

AI and new risks 10. Does the contract clearly address whether the BPO can use policyholder data for AI model training? 11. Does the BPO have a written AI governance policy that covers your data?

Exit 12. Does the contract include specific data deletion commitments and a way to verify the data was actually deleted when the engagement ends?

Score your arrangements. If you are below 6, in my view, the current contract will not hold up if a regulator seriously looks at it.

The bottom line

The industry has largely treated outsourcing data privacy as a problem you can solve with sharper contract language. In my view, this is the structural weakness that will be exposed over the next two years as DPDP and HIPAA enforcement picks up.

Blame does not transfer when you outsource. It extends. You remain the Data Fiduciary. You remain the Covered Entity. The BPO’s duties run alongside yours, not in place of them. The right question is not who takes the blame. The right question is how much visibility and control you have over what is now an extension of your own operation.

Insurers who make this shift early will find their outsourcing arrangements both more compliant and more honest about what the BPO is actually doing. Insurers who do not will find out, during the regulatory review that follows the next breach, that the strong indemnity clause did not protect them the way they thought it would.

If this reads like a diagnosis of your current outsourcing posture, that is because the pattern is common enough across the industry to be worth naming out loud. We are built for this conversation.