dpdpr.in
Am I covered?

Before my car insurance renewal, dozens of agents call and WhatsApp me

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

"A month before renewal, I got twenty calls a day. They all knew my car model, my policy end date and my insurer."

The situation in a citizen's own words, paraphrased from public reports. No names or personal details.

Your policy data sits with your insurer, its agents and brokers, and sometimes aggregators you used. Each must keep it confidential. Block insurance marketing on DND, complain about each call, and ask your insurer in writing who received your renewal data.

Safety first. Threatened or in danger: call 181 (women) or go to the nearest police station. Lost money: call 1930 at once.

Your rights

  • Right to stop marketing calls and SMS. Register DND by sending FULLY BLOCK to 1909. A spam complaint made within 7 days is valid and your telecom company must act on it (TRAI TCCCPR, 2018, as amended in 2025).
  • Right to confidentiality. IRDAI's 2024 Policyholders' Interests Regulations (regulation 15) bind insurers and distribution channels such as brokers and web aggregators.
  • Right to complain to IRDAI through Bima Bharosa if the insurer or intermediary does not resolve it.
  • Right to withdraw consent (from 13 May 2027). Withdrawing must be as easy as giving consent, and the company must then stop processing (DPDP section 6(4) and 6(6)).
  • DPDP rights from 13 May 2027. You can ask what data the company holds and who it shared it with (section 11), ask for correction or erasure (section 12), and complain to the company, then to the Data Protection Board (sections 13 and 27). The company answers for its processors (section 8(1)).

How to fight it, step by step

One action per step. Each step says what to write, what to attach, what you get back, and how long to wait before the next step. If the person turns out to be fake, skip to If it is fake.

  1. Save the evidence before you block or delete anything.
    What to write: A short note with the date, time, number used, and exactly what was said or what details they knew.
    What to attach: Screenshots of the call log, SMS, WhatsApp chats (with the number visible), and any payment screen.
    What you get back: A record that cannot later be denied.
    How long to wait: Do this the same day.
  2. Register DND: send FULLY BLOCK to 1909 from the number being called.
    What to write: FULLY BLOCK (or BLOCK followed by a category number).
    What to attach: Nothing.
    What you get back: A reply SMS from your operator.
    How long to wait: TRAI's notice allows up to 7 days for DND to take effect.
  3. Complain about each marketing call or SMS on Chakshu (Report Spam (UCC)) or by SMS to 1909.
    What to write: The UCC, the sender's number, the date.
    What to attach: A screenshot of the call log or SMS.
    What you get back: A complaint ID from your operator.
    How long to wait: Do it within 7 days of the call; after that it is only a report.
  4. Write to the company's grievance officer asking it to stop and to name its source.
    What to write: Letter 2 below: stop all marketing, delete my number from your lead lists, and tell me where you got it.
    What to attach: Screenshots with dates and numbers.
    What you get back: An acknowledgement.
    How long to wait: 30 days, or the time its policy states.
  5. If the caller is an insurer or broker, write to its Grievance Redressal Officer.
    What to write: That you did not consent to sharing and want the calls to stop.
    What to attach: Screenshots and the aggregator's name.
    What you get back: An acknowledgement.
    How long to wait: 15 days.
  6. Register on bimabharosa.irdai.gov.in, or call 155255.
    What to write: The insurer or intermediary, your complaint and its reply.
    What to attach: Letters and evidence.
    What you get back: A Token Number.
    How long to wait: Track it with the Token Number.
  7. Call the National Consumer Helpline on 1915, or file on consumerhelpline.gov.in.
    What to write: The company's name, your complaint number with it, what went wrong, and what you want (for example: action against the person, written confirmation, compensation).
    What to attach: Your complaint, the company's replies, and screenshots.
    What you get back: A docket number. The helpline takes your complaint up with the company. It is free and comes before a court case.
    How long to wait: Give it a few weeks. If nothing changes, go to the Consumer Commission.
  8. Get a lawyer if the stakes are high.
    What to write: Nothing yet. Take your full file to the lawyer.
    What to attach: All of the above.
    What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages.
    How long to wait: Before you send any legal notice or file a suit. This page is not legal advice.

What people tried and what worked

  • People said their policy was already renewed, blocked numbers, complained through DND, and bought directly from the insurer.
  • Saying 'already renewed' ended calls quickly for one person; DND complaints were recommended.

Based on reports on public forums. Paraphrased, with no usernames or personal details. What worked for one person may not work for you; the numbered steps above are the official route.

Not legal advice. This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

Step 1: stay safe and find out who it is

  1. Do not share an OTP, PIN, password or card number.
  2. Ask for their name, company, role and ID. Write it down.
  3. Hang up and call the company on a number you find yourself, on its official website or app.
  4. Ask whether this person works for the company or a partner. Ask for a written answer (Letter 1 below).

If it is genuine: hold the company accountable

Which rules this may break

  • IRDAI Policyholders' Interests Regulations, 2024, regulation 15: confidentiality and no sharing with third parties without explicit consent, with listed exceptions.
  • TRAI TCCCPR, 2018 (amended 2025) for the calls themselves.
  • DPDP Act from 13 May 2027: purpose limited consent and withdrawal.

What the company must do, and by when

  • Stop calling once you have registered DND or withdrawn consent.
  • Tell you, if you ask, where it got your number.
  • From 13 May 2027: erase your data once the purpose is over or you withdraw consent (section 8(7)), and answer for its lead vendors (section 8(1)).

Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, [Insurance web aggregator or broker name]
Subject: Please confirm whether this person works for you

Dear Sir or Madam,

I am your customer. My quote or lead reference: [number].

On [date] at [time] I received a call or message from [phone number]. This is not an official number. The person said they were [name], [role or employee ID], from the aggregator. They knew my [list the details they knew].

Please confirm in writing within 7 days:
1. Whether this person is your employee, agent, insurer, broker, call centre vendor or partner.
2. If yes, their name, role and the agency they work for.
3. Whether you allow staff or agents to contact customers from personal numbers.
4. If they are not connected with you, please say so, so I can report the number.

Name:
Registered mobile number:
Date:

Letter 2: ask how your data got there

To: The Grievance Officer, [Insurance web aggregator or broker name]
Subject: How did my personal data reach a personal phone? Complaint number [if any]

Dear Sir or Madam,

On [date] a person connected with you, [name if known], contacted me from a personal number [number] and knew my [details]. [Describe what they did.]

Please tell me in writing:
1. What personal data about me this person could see, and through which system or app.
2. Whether you shared my data with any agency, insurer, broker, call centre vendor, partner or processor, and their names.
3. How my data reached a personal phone or account outside your official systems.
4. What action you have taken against the person or agency, including suspension while you investigate.
5. What you have done to stop this happening again.
6. The name of every company you bought my number from or sold it to.
Under the IRDAI (Protection of Policyholders' Interests and Allied Matters of Insurers) Regulations, 2024 (regulation 15), insurers and distribution channels must keep information confidential and must not share it with third parties without your explicit consent, except as the regulation allows. Marketing calls are also covered by TRAI's TCCCPR, 2018.

From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply.

Please reply within 30 days. If I do not hear from you, I will escalate to TRAI's complaint route through my telecom company, the National Consumer Helpline and, from 13 May 2027, the Data Protection Board.

Name:
Registered mobile number:
Date:

Evidence to keep

  • Screenshots of calls and messages with numbers, dates and times.
  • Order, booking, policy or account numbers.
  • Your complaint numbers and the company's replies.
  • A note of what the caller knew or did.

More in the evidence checklist.

Can you sue? What realistically happens

  • Consumer Commission: the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
  • IT Act section 43A (until 13 May 2027): if the company was negligent with sensitive personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
  • Civil suit for damages: possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
  • Police: only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
  • Realistic outcome: most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

From 13 May 2027: the Data Protection Board

From 13 May 2027 the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but penalties go to the Government (the Consolidated Fund of India, section 34), not to you. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

If it is fake: urgent steps

  1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud.
  2. Call 1930 if money was lost, then file on cybercrime.gov.in.
  3. Report the number on Chakshu (Sanchar Saathi).

Step by step guides:

Block marketing calls and SMS (DND) and complain by SMS to 1909

Block marketing calls and SMS (DND) and complain by SMS to 1909

1909 is a free short code on every Indian mobile network. You can block commercial calls and messages, and complain about spam. These codes are from TRAI's own public notice.

Keep this ready before you start:

  • The phone with the SIM you want to protect.
  1. To block all commercial calls and SMS except transactional ones, send an SMS with the text FULLY BLOCK (or BLOCK 0) to 1909.
  2. To block all except transactional and service messages, send BLOCK PROMO (or BLOCK 50) to 1909.
  3. To block only one category, send BLOCK 1 (banking, insurance, financial products, credit cards), BLOCK 2 (real estate), BLOCK 3 (education), BLOCK 4 (health), BLOCK 5 (consumer goods and automobiles), BLOCK 6 (communication, broadcasting, IT), BLOCK 7 (tourism and leisure) or BLOCK 8 (food and beverages).
  4. You can also dial *1909*0# (USSD), or call 1909 and follow the voice menu, or use the TRAI DND app.
  5. Keep any reply SMS you get from your operator.
  6. To complain about a spam SMS or call, send an SMS to 1909 in this format: The UCC, XXXXXXXXXX, dd/mm/yy. Put the spam text or a short description first, then the sender's number or header, then the date.
  7. Do it within 7 days of the spam. Under TRAI's 2025 amendment a complaint is valid if it has the sender's number, your number, the date and a short description.
  8. Save the complaint ID your operator sends.

Checked on 1 November 2026 against: TRAI public notice: block commercial calls and SMS through 1909, TRAI FAQ on unsolicited commercial communication (SMS complaint format), TRAI: TCCCPR (Second Amendment) Regulations, 2025 (complaint within 7 days), PIB, 12 February 2025: TRAI amends TCCCPR, 2018.

Complain about a marketing call or SMS on Chakshu (within 7 days)

Complain about a marketing call or SMS on Chakshu (within 7 days)

Use this for unwanted marketing (spam) that is not a fraud. A complaint made within 7 days of the call or SMS is a valid complaint and the telecom company must act on it. After 7 days it only counts as a report.

Keep this ready before you start:

  • A screenshot of the call log or SMS.
  • The number or header (for example AB-XYZBNK-P) that sent it.
  • Date and time (within the last 7 days).
  • Your mobile number, your telecom company, your State and telecom circle.
  1. Open sancharsaathi.gov.in/sfc or the Sanchar Saathi app.
  2. Under Report Spam (UCC), click Proceed.
  3. Choose the medium: Call or SMS.
  4. Choose the category, for example Banking/insurance/financial products/credit cards, Real Estate, Education or Health.
  5. Attach the screenshot.
  6. Type the sending number or header. (If the number is international, the form sends you to the fraud section instead.)
  7. Enter the date and time.
  8. Write the details in at least 10 characters. Add any numbers or links in the message.
  9. Enter your number. Choose your telecom company (Airtel, BSNL, RJIL, TATA or Vodafone Idea), your State and your circle.
  10. Type the captcha, verify your number with OTP, tick the declaration, click Preview, then Submit.
  11. Save the complaint ID you are given.
  12. Track it on your telecom company's page. Sanchar Saathi lists these: Airtel airtel.in/track-request, BSNL ucc-bsnl.co.in/customers, Jio jio.com/track_sr_status, Vi through the Vi app.

Checked on 1 November 2026 against: Chakshu: report suspected fraud or spam (Sanchar Saathi), Sanchar Saathi portal and FAQ (Department of Telecommunications), TRAI: TCCCPR (Second Amendment) Regulations, 2025 (complaint within 7 days).

Complain to the insurer, then IRDAI Bima Bharosa

Complain to the insurer, then IRDAI Bima Bharosa

IRDAI is the insurance regulator. Its route is: the insurer's Grievance Redressal Officer, then IRDAI's Bima Bharosa system, and the Insurance Ombudsman.

Keep this ready before you start:

  • Policy number.
  • Claim number, if any.
  • Your written complaint to the insurer and its reply.
  • Proof of what the agent or caller knew or said.
  1. Write to the insurer's Grievance Redressal Officer, or walk into any office of the insurer. IRDAI lists every insurer's officer at irdai.gov.in/list-of-gros.
  2. Get a written, dated acknowledgement.
  3. The insurer should resolve it within 15 days (two weeks).
  4. If not, open bimabharosa.irdai.gov.in, create a profile and register your complaint.
  5. Save the Token Number you get by email or SMS. Use it to track.
  6. Or call IRDAI's call centre on 155255 or 1800 4254 732 (8 AM to 8 PM, Monday to Saturday), or email [email protected].
  7. If the insurer's answer is still not acceptable, the Insurance Ombudsman is listed at cioins.co.in. Check its time limits there before filing.

Checked on 1 November 2026 against: IRDAI Bima Bharosa: FAQ and complaint route, IRDAI grievance call centre.

Related guides

See also when a platform shares your data with a third party and the escalation ladder.

Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

On this page
  1. Your rights
  2. How to fight it
  3. What people tried
  4. Step 1: verify
  5. If genuine
  6. Letters
  7. Can you sue?
  8. Data Protection Board
  9. If fake
  10. Sources