California Overhauls Its Insurance Privacy Law: What SB 354 Means for Insurers

At a Glance

• The Act will require covered insurance companies to make coordinated changes across their privacy, underwriting, marketing, claims, vendor management, information security, and records-management programs.
• Companies must establish a process for consumers to access, correct, amend, or delete personal information held by the company or its service providers.
• Because the Act spans underwriting, claims, marketing, information technology, and procurement, covered entities should begin preparing well before the date it becomes operative, July 1, 2028.

On September 27, 2026, Governor Gavin Newsom signed Senate Bill 354, repealing California's Insurance Information and Privacy Protection Act (IIPPA) and replacing it with a modernized Insurance Information and Privacy Protection Act (the Act). The Act establishes new standards for the processing and sharing of consumers' personal information by licensees, surplus line insurers, reinsurers, and their third-party service providers. It becomes operative on July 1, 2028, when the existing IIPPA becomes inoperative; and the California insurance commissioner must adopt regulations no later than January 1, 2029, applying key provisions to producers, including sample notices, forms, and compliance documents.

The Act governs the collection, use, storage, disclosure, analysis, deletion, retention, or modification of personal information, collectively "processing" and "sharing," drawing on the California Consumer Privacy Act (CCPA) but tailoring its concepts to underwriting, claims, and other insurance functions.

Scope of the Act

Who and What Is Covered?

The Act applies broadly across the insurance industry, including insurance department licensees, surplus lines insurers, reinsurers, and their third-party service providers. Its requirements generally extend to personal lines activities involving applicants, policyholders, claimants, and beneficiaries. Commercial lines may also fall within scope when an individual brings a claim under a commercial policy for personal, family, or household purposes. For group insurance arrangements, required notices may be provided to the sponsoring employer rather than to each individual participant.

The Act defines "personal information" expansively to include information processed or shared in the business of insurance that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular consumer or household. In addition to traditional identifiers and insurance-related records, the definition encompasses biometric information, neural data, and other categories of sensitive personal information. As a result, insurers should take a broad view of their data environment when assessing compliance obligations. In addition to policy administration and claims systems, personal information may be collected, used, or stored through online application tools, customer and agent portals, mobile apps, telematics programs, website technologies, marketing platforms, CRM systems, call center operations, analytics environments, fraud prevention tools, document repositories, and third-party service provider platforms.

Who Is Protected?

The Act protects California residents whose information is handled in connection with insurance, including current and former applicants, policyholders, insureds, claimants, beneficiaries, participants, annuitants, and certificate holders. Information used only in an employment or contractor relationship is excluded.

Who Is Exempted?

The Act generally exempts SEC-regulated firms, Gramm-Leach-Bliley Act (GLBA)-regulated depository institutions, California Confidentiality of Medical Information Act (CMIA)-regulated health care providers, HIPAA-covered entities and business associates, and title insurers. Limited or partial exemptions apply to certain lending activities of California insurance licensees, surplus lines advisory organizations, producers, and wholesale intermediaries, although specific notice, data-use, security, oversight, and breach-notification requirements may still apply. The Act also continues to cover disability insurers that are licensed to transact health insurance but are not Knox-Keene-regulated health care service plans.

Key Provisions

The Act will require covered insurance companies to make coordinated changes across their privacy, underwriting, marketing, claims, vendor management, information security, and records-management programs. The provisions below outline key compliance obligations.

1. Initial and Annual Privacy Notices

   The Act requires companies to provide consumers with a clear, stand-alone privacy notice within 21 calendar days after first collecting, processing, or sharing their personal information. This requirement is not limited to customers who purchase a policy. Applicants and claimants are also "consumers" under the Act. Existing customers must receive a compliant notice at renewal, reinstatement, or when a new processing or sharing activity occurs if they have not already received one.

   There are limited exceptions. For example, a company generally does not need to provide notice when it does not issue a policy and does not further process the applicant's personal information. For group policies, notice may be provided to the employer rather than each plan participant. Certain beneficiaries, emergency contacts, and other individuals whose information is used only to complete the insurance transaction may also be excluded.

   Companies must also provide an updated privacy notice at least annually while the customer relationship continues. The annual notice may be combined with the initial notice and generally is not required for former consumers, most claimants, or other exempt categories. In practice, companies will need processes to track when notices are required, deliver them on time, and document compliance throughout the life of a policy, not simply at onboarding.

2. Information Sharing

   When information may be shared without consent. Companies may share personal information when reasonably necessary and proportionate for insurance activities such as underwriting, account servicing, actuarial work, claims handling, fraud prevention, and value-added services. Sharing is also permitted for legal and regulatory compliance and certain transactions, including protecting a lienholder's interest or completing a merger or acquisition.

   When opt-in consent is required. Companies generally must obtain the consumer's affirmative consent before using or sharing information for specified marketing or research activities, or for purposes the Act does not otherwise authorize.

   When an opt-out is required. For joint marketing, cross-marketing, marketing the company's own products, affiliate sharing, and FAIR Plan clearinghouse activities, companies may share information after giving consumers notice and an opportunity to opt out. Sensitive personal information may be used only for permitted purposes or for other disclosed purposes subject to an opt-out. In all cases, the use must be reasonably necessary and proportionate to the stated purpose.

   Companies should review how they obtain consent. Consent must be freely given, specific, informed, unambiguous, and capable of being recorded. General terms of use, passive actions such as hovering over or closing content, and interfaces that improperly steer consumer choices do not qualify.

   The Act also prohibits selling personal information for money or other value. The prohibition does not cover disclosures to service providers supporting a consumer-requested insurance product or service, sharing with insurance support organizations, statistical agents, or reinsurers for an insurance transaction, or transfers through a merger, acquisition, or bankruptcy.

3. Records Retention and Deletion

   Companies may keep personal information only for purposes the Act permits and must maintain a written retention policy and schedule that can be provided to the California insurance commissioner upon request. Beginning January 1, 2032, they must review and update those materials, and assess whether retained personal information is still needed, at least once every three years.

   When information is no longer needed, companies must take reasonable steps to securely delete, destroy, or de-identify it in line with their retention schedules. Exceptions apply to information retained for fraud detection or prevention or as otherwise required by law.

4. Adverse Underwriting Decisions

   When a company denies or terminates coverage, or offers life, health, or disability coverage at higher-than-standard rates, it must provide the specific reasons in writing or explain how the consumer may request them. Consumers have 90 business days to seek additional information, and the company must respond within 21 business days.

5. Consumer Access, Correction, Amendment, and Deletion

   Companies must establish a process for consumers to access, correct, amend, or delete personal information held by the company or its service providers. They must acknowledge access requests within five business days and respond within 30 business days with the information, its sources, recipients from the current year and at least the prior three calendar years, and an explanation of correction procedures. A request may be denied only for good cause, and consumers must be allowed to submit a statement of disagreement.

6. Third-Party Service Provider Contracts

   Companies should plan to review and likely amend their service-provider agreements. Contracts must address how personal information is processed and shared and include required privacy protections. Service providers must also report security incidents and breaches both to the company and directly to the California insurance commissioner.

7. Information Security, Breach Notification, and Recordkeeping

   Covered companies must maintain an information security program with appropriate administrative, technical, and physical safeguards. They generally must notify the California insurance commissioner of a breach promptly after discovery and retain evidence of compliance for the year of the activity plus five additional calendar years.

8. Nonretaliation and Other Provisions

   Companies may not penalize consumers for exercising their rights — for example, by charging different rates, refusing coverage, denying a claim, or conditioning a product on consent to unrelated sharing. The Act also restricts pretext interviews and the use of genetic information in underwriting, requires removal of consumer data from salvage vehicles and returned devices, and generally preempts inconsistent state consumer privacy laws while preserving health-information protections.

9. Penalties and Remedies

   Noncompliance can carry significant consequences, including:

   • A penalty of at least $5,000 for each violation the entity was aware of or should have been aware of, not to exceed $1,000,000 in the aggregate for multiple violations.
   • A fine of at least $15,000 for each violation of a cease and desist order.
   • A fine of at least $50,000 for each violation if the California insurance commissioner finds the violations to be a general business practice, and possible suspension or revocation of the license.
   • A misdemeanor, punishable by a fine of up to $50,000, imprisonment in a county jail for up to six months, or both, for a person who knowingly and willfully obtains information about a consumer from a licensee, surplus line insurer, reinsurer, or third-party service provider under false pretenses.

   Consumers may also seek equitable relief for violations of their access, correction, or adverse underwriting rights and actual damages for improper disclosures. Courts may award costs and reasonable attorney's fees to the prevailing party. Claims generally must be filed within two years after the violation was or should have been discovered, and the Act does not create any other private remedy.

Recommended Next Steps

Because the Act spans underwriting, claims, marketing, information technology, and procurement, covered entities should begin preparing well before July 1, 2028, including to:

• Prepare stand-alone initial and annual privacy notices and delivery procedures meeting the 21-calendar-day deadline
• Update adverse underwriting decision notices to meet the 90- and 21-business-day timelines
• Amend third-party service provider contracts, including direct breach reporting to the California insurance commissioner
• Map the processing and sharing of personal information, classify sensitive personal information, and implement opt-in and opt-out consent mechanisms free of dark patterns
• Build processes to meet the 5- and 30-business-day access, correction, amendment, and deletion deadlines, and update retention schedules and breach response plans
• Monitor forthcoming Department of Insurance regulations, including the producer regulations due no later than January 1, 2029

Legal clerk Patricia Jo English-Klitzke contributed to this update.