#FactCheck -Viral Photo Misidentifies Woman With Education Minister as NEET Paper Leak Accused; Fact Check Finds Claim False

Introduction

The insurance industry is a target for cybercriminals due to the sensitive nature of the information it holds. This makes it essential for insurance companies to have robust cybersecurity measures to protect their data and customers’ personal information.

Cyber fraud in India’s insurance industry is increasing. It is reported that the Indian insurance sector has witnessed a surge in cyber-attacks, with several instances of data breaches, identity thefts, and financial fraud being reported. These cybercrimes not only pose a significant threat to the financial stability of the insurance industry but also to the privacy and security of policyholders.

Cyber Frauds in the Insurance Industry

The insurance industry in India has been the target of increasing cyber fraud in recent years. With the growing digital transformation trend, insurance companies have become increasingly vulnerable to cyber-attacks. Cyber frauds in the insurance industry are initiated by hackers who use various techniques such as phishing, malware, ransomware, and social engineering to gain unauthorised access to policyholders’ personal data and sensitive information

Kinds of cyber frauds in the insurance industry

It is essential for insurers and policyholders alike to be aware of these kinds of cyber-attacks on insurance companies in today’s digital age. Staying educated about these threats can help prevent them from happening in the future.

Identity theft– One common type of cyber fraud that occurs in the insurance industry is identity theft. In this type of fraud, criminals steal personal information such as name, address, date of birth and social security numbers through phishing emails or fraudulent websites. They then use this information to open fraudulent policies or access existing ones.

Payment fraud- Another type of cyber fraud that is on the rise is payment fraud. In this type of fraud, hackers intercept electronic payments made by policyholders or agents using fake bank accounts or compromised payment gateways. The money is then siphoned into untraceable accounts, making it difficult for law enforcement agencies to identify and arrest the perpetrators.

Phishing attacks- Where the fraudsters posed as company officials and sent emails to policyholders requesting their account details. The unsuspecting customers fell for this scam and shared their sensitive information, which was then used to access their accounts and steal funds.

Hacking- Where hackers breach the company’s system to gain access to policyholder data. The hackers’ stoles personal records, including names, addresses, phone numbers, social security numbers, and financial information, which they later sell on the dark web.

Fake policies scam- Fraudsters create fake policies using stolen identities and collect premiums from innocent customers. The insurer then voided these policies due to fraudulent activity leaving those people without valid coverage when they needed it most. The victims suffer significant financial losses due to this scam.

Fake Insurance Websites- Discuss the creation of deceptive websites that imitate well-known insurance companies, where unsuspecting individuals provide their personal details, leading to identity theft or financial losses.

Prevention of Cyber Frauds in the Insurance Industry- Best practices to follow

Prevention is better than cure, which also holds true in the case of cyber fraud in the insurance industry. The industry must take proactive steps to prevent such frauds from occurring in the first place. One of the most effective ways to do so is by investing in cybersecurity measures that are specifically designed for the insurance sector.

Insurance companies must conduct regular employee training programs on cybersecurity best practices. This includes educating employees on how to identify and avoid phishing emails, create strong passwords, and recognise potential cyber threats. Companies should also establish a reporting mechanism for employees to report suspicious activity or incidents immediately.

Having proper access controls in place is also necessary. This means limiting access to sensitive data only to those employees who need it, implementing two-factor authentication, and regularly monitoring user activity logs. Regular audits can also provide an extra layer of protection against potential threats by identifying vulnerabilities that may have been overlooked during routine security checks.

Another essential step is encrypting all data transmitted between different systems and devices. Encryption scrambles data into unreadable codes that can only be deciphered using a decryption key, making it difficult for hackers to intercept or steal information in transit.

Legal Framework for Cyber Frauds in the Insurance Industry

The legal framework for cyber fraud in the insurance industry is critical to preventing such crimes. The Insurance Regulatory and Development Authority of India (IRDAI) has issued guidelines for insurers to establish a cybersecurity framework. The guidelines require insurers to conduct regular risk assessments, implement security measures, and ensure compliance with data privacy laws.

The Information Technology Act 2000, is another significant piece of legislation dealing with cyber fraud in India. The act defines offences such as unauthorised access to a computer system, hacking, and tampering with data. It also provides for stringent penalties and imprisonment for those found guilty of such offences.

The IRDAI’s guidelines provide insurers with a roadmap to establish robust cybersecurity measures to help prevent cyber fraud in the insurance industry. Stringent implementation of these guidelines will go a long way in safeguarding sensitive customer information from falling into the wrong hands.

Best Practices for Insurers and Policyholders

Insurers:

Implementing Strong Authentication: Encouraging the use of multi-factor authentication and secure login processes to safeguard customer accounts and prevent unauthorised access.

Regular Employee Training: Conduct cybersecurity awareness programs to educate employees about the latest threats and preventive measures.

Investing in Advanced Technologies: Utilizing robust cybersecurity tools and systems to promptly detect and mitigate potential cyber threats.

Policyholders:

Vigilance and Awareness: Policyholders must stay vigilant while sharing personal information online and verify the authenticity of insurance websites and communication channels.

Regular Updates and Patches: Advising individuals to keep their devices and software up to date to minimise vulnerabilities that cybercriminals can exploit.

Secure Online Practices: Encouraging the use of strong and unique passwords, avoiding sharing sensitive information on unsecured networks, and exercising caution when clicking on suspicious links or attachments.

Conclusion

As the Indian insurance industry embraces digitisation, the risk of cyber scams and data breaches becomes a significant concern. Insurers and policyholders must collaborate to ensure robust cybersecurity measures are in place to protect sensitive information and financial interests.

It is essential for insurance companies to invest in robust cybersecurity measures that can detect and prevent fraud attempts. Additionally, educating employees on the dangers of cyber fraud and implementing strict compliance measures can go a long way in mitigating risks. With these efforts, the insurance industry can continue to provide trustworthy and reliable services to its customers while protecting against cyber threats. As technology continues to evolve, it is imperative that the insurance industry adapts accordingly and remains vigilant against emerging threats.

Introduction

Company law solved a version of this problem more than a century ago, and artificial intelligence regulation is now quietly borrowing the solution. When something goes wrong inside a company, the law generally cannot reach past the corporate entity to punish the people who ran it, because the company is treated as a legal person entirely separate from its shareholders and directors. Courts developed an exception for exactly the cases where that separation becomes a shield for wrongdoing, and lawyers now call it lifting, or piercing, the corporate veil. A growing body of legal scholarship argues that AI systems present a strikingly similar problem, and needs a strikingly similar fix. That emerging idea has come to be called lifting the AI veil.

Where the original doctrine comes from

The doctrine of lifting the corporate veil traces directly to the House of Lords decision in Salomon v. Salomon & Co. Ltd. in 1897. Aron Salomon, a leather and boot manufacturer, incorporated his existing business, sold it to the new company, and structured share ownership so that he and his family held nearly all the shares. When the company later failed, creditors argued Salomon should be held personally liable, since the company was effectively just him operating under a different name. The House of Lords disagreed, holding decisively that once validly incorporated, a company is a person in law entirely distinct from its subscribers, with its own rights and liabilities. That ruling established what remains company law's foundational principle: separate legal personality.

Separate personality is not, however, unconditional. Courts across common law jurisdictions, including India, carved out an exception for cases where the corporate form is used as a facade for fraud, to evade a statutory obligation, or to circumvent a legal duty that would otherwise apply to the individuals behind it. In such cases, a court will "lift the veil," looking past the company's separate legal identity to attribute liability directly to the directors or shareholders actually in control. India's Supreme Court, in Life Insurance Corporation of India v. Escorts Ltd., reaffirmed that this remains an exception applied only in narrow, exceptional circumstances, generally where a statute contemplates it, or fraud or improper conduct needs to be prevented. The doctrine has since found application well beyond fraud alone, including in tax matters, as seen in cases like State of U.P. v. Renusagar Power Co., where courts treated closely related corporate entities as one for the purpose of a specific statutory benefit.

Why AI creates the same structural problem

Scholarship examining AI liability has increasingly pointed to a near identical structural gap. As AI systems take on functions once reserved for human decision makers, board level analytics, automated lending decisions, algorithmic hiring, even proposed "robo-director" advisory roles, a familiar question resurfaces: who answers for the outcome when the AI system, rather than a named individual, produced the decision. A 2025 academic paper titled Lifting the AI Veil in Company Law argues explicitly that AI liability should be approached through an extension of existing doctrines, including directors' duty of care and precisely the piercing of the veil doctrine traditionally reserved for shareholders, rather than inventing an entirely new liability regime from scratch.

The concern driving this argument is not abstract. Commentary in outlets like MIT Technology Review has warned that granting AI systems anything resembling legal personhood risks handing companies a genuinely dangerous new shield, allowing a company to argue that a harmful outcome was the AI's autonomous decision, disconnected from any human actor's intent or negligence, much as a company might once have argued a harmful outcome was simply "the company's" doing and not any individual's. Critics of AI personhood proposals, writing in journals examining AI as legal persons, make the parallel explicit: while corporate veil piercing exists precisely to stop the corporate form being misused as a liability shield, the justification for extending similar legal personhood to AI is considerably weaker, since corporate personhood serves a clear economic purpose, enabling investment and risk pooling, that AI personhood does not obviously replicate.

How regulators have actually responded

The European Union's experience is instructive precisely because it shows the doctrine's underlying logic being adopted through legislation rather than judicial precedent. The European Commission originally proposed a dedicated AI Liability Directive in September 2022, intended to ease the burden of proof on claimants harmed by AI systems, including a rebuttable presumption of causality where a claimant could show an AI system breached EU AI Act obligations. That proposal was formally withdrawn in 2025, with the withdrawal notice published in the Official Journal on 6 October 2025, after member states failed to reach agreement. In its place, the revised EU Product Liability Directive now does much of the same underlying work through a different legal mechanism, explicitly treating AI software as a "product" for the purposes of manufacturer liability, meaning AI providers face strict liability for defective AI products without claimants needing to prove fault, applicable to AI products placed on the EU market from 9 December 2026 onward. Functionally, this achieves something close to piercing the AI veil by statute: instead of allowing a company to attribute harm to an autonomous algorithmic process and stop the inquiry there, liability is anchored back to the entity that built, trained, or deployed the system.

The Indian angle, and why it matters here

India has no AI specific liability statute at present, and no reported judicial decision has yet applied the corporate veil piercing doctrine by analogy to an AI system. But the underlying legal architecture is already familiar territory for Indian courts. India's jurisprudence on lifting the corporate veil, built through Escorts, Renusagar, and subsequent cases, already establishes the judicial comfort with looking past a formal legal structure to find the real, controlling actor when justice demands it. Indian courts have been consistently clear that this remains an exceptional remedy rather than a routine one, generally invoked where a statute contemplates it, where fraud or improper conduct needs to be prevented, or where a taxing or beneficial statute would otherwise be defeated by rigid adherence to corporate form. That same cautious, fact specific posture is likely to shape how any future Indian AI liability doctrine develops, applied sparingly rather than as a blanket rule.

As AI systems increasingly mediate lending decisions, insurance claims processing, and algorithmic hiring in Indian companies, the same reasoning that let Indian courts see through a corporate facade could plausibly extend to seeing through an "AI made the decision" defence, attributing responsibility to whichever human actor, developer, deployer, or governing board, exercised actual control over how that system was built and used. Given how central technology sector employment and AI deployment already are to India's economy, the absence of a clear domestic answer to this question is unlikely to remain untested for long.

The larger point

The doctrine of lifting the AI veil is less a wholly new legal invention and more a recognition that AI systems and corporations create the same essential problem: a formally separate entity that can, if left unchecked, absorb blame that properly belongs to the humans directing it. Company law solved this by refusing to let the corporate form become an alibi. AI law, whether through judicial doctrine, statute, or a hybrid of both as the EU's experience suggests, will likely need to reach the same conclusion, because the alternative is allowing genuine harm to disappear into a system nobody can be made to answer for.

References

1. Bird & Bird, "Proposed EU AI liability rules withdrawn." https://www.twobirds.com/en/insights/2025/proposed-eu-ai-liability-rules-withdrawn
2. LegalClarity, "AI Liability Directive: What It Was and Why It Was Withdrawn." https://legalclarity.org/ai-liability-directive-what-it-was-and-why-it-was-withdrawn/
3. WCR Legal, "EU AI Liability Directive: Withdrawn, What Now Applies?" https://wcr.legal/eu-ai-liability-directive-withdrawn-pld/
4.  Verfassungsblog, "Anatomy of a Fall: On the Anticipated Withdrawal of the AI Liability Directive Proposal." https://verfassungsblog.de/anatomy-of-a-fall-aiact-aild-pld/
5. MIT Technology Review, "Debates over AI consciousness are a trap." https://www.technologyreview.com/2026/08/20/1142571/ai-consciousness-debate-trap/
6. ResearchGate, "Lifting the AI Veil in Company Law." https://www.researchgate.net/publication/393305638_Lifting_the_AI_veil_in_company_law
7. Review of Law and Regulation, "Lifting the AI Veil in Company Law." https://rlr.iup.rs/wp-content/uploads/2025/07/04.pdf
8.  Bhatt & Joshi Associates, "Decoding the Jurisprudence on Lifting the Corporate Veil in Indian Court. https://bhattandjoshiassociates.com/decoding-the-jurisprudence-on-lifting-the-corporate-veil-in-indian-court/
9. Mondaq, "Analysis Of Standard Of Proof For Lifting Of The Corporate Veil In Cases Of Fraud." https://www.mondaq.com/india/corporate-and-company-law/1259382/analysis-of-standard-of-proof-for-lifting-of-the-corporate-veil-in-cases-of-fraud
10. Record Of Law, "Analysis of the theory of corporate veil lifting." https://recordoflaw.in/analysis-of-the-theory-of-corporate-veil-lifting/
11. Suren Uppal Offices, "Lifting of Corporate Veil: Navigating Judicial Precedents." https://www.suolaw.com/lifting-of-corporate-veil-navigating-judicial-precedents/

‍

Somewhere in a compliance meeting right now, someone is saying "we have eighteen months, we're fine." That sentence is doing the same thing a snooze button does at 6 a.m.: technically buying time, while quietly making the actual wake up call worse. India's data protection law just started its countdown, and the 18 months everyone keeps citing is not a grace period to procrastinate through. It is closer to a runway before takeoff. Runways exist for one purpose: building up speed until the plane has no choice but to leave the ground. Standing still on one is not a strategy.

‍

What actually got notified, and when

‍

On 13 November 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, giving operational shape to the Digital Personal Data Protection Act that Parliament had passed back in August 2023. Alongside the Rules themselves, MeitY issued a separate Enforcement Notification setting out exactly when different provisions kick in, and a further notification establishing the Data Protection Board of India, headquartered in the National Capital Region with four members. The final Rules followed a genuinely deliberative process, MeitY had floated draft Rules in January 2025 for public consultation and received 6,915 individual inputs from startups, industry bodies, civil society groups, and citizens before finalising the version now in force. The headline structural decision, and the one causing the most confusion in boardrooms, is that the Rules do not commence all at once. They commence in three distinct phases spread across eighteen months, and different obligations become legally binding at each stage.

‍

The phased timeline, laid out plainly

‍

‍

That third date, 13 May 2027, is the one that matters most for the vast majority of organisations, since it is where the bulk of actual operational obligations, the parts that touch product design, customer facing notices, and breach response, become enforceable. Legal commentary tracking the rollout has been consistent that this is described as a hard deadline with no grace period expected once it arrives, since the Data Protection Board is already operational and can begin receiving complaints well before Phase 3 obligations formally take effect.

‍

Why "later" is a genuinely expensive plan

‍

The financial stakes attached to Phase 3 non-compliance are not modest. The Schedule to the DPDP Act sets fixed penalty ceilings rather than turnover linked fines, which sounds gentler than Europe's GDPR model until you look at the actual numbers. Failure to implement reasonable security safeguards that results in a data breach can draw a penalty of up to 250 crore rupees per instance, the single highest tier in the Schedule. Failing to notify the Board or affected individuals after a breach occurs can draw up to 200 crore rupees, as can non-compliance with the Act's specific protections for children's data. Because these are assessed per instance rather than as a single capped exposure, a single incident that trips more than one obligation, say, inadequate safeguards that also delay breach notification, can compound into penalty exposure running into hundreds of crores from one event. All penalties collected go to the Consolidated Fund of India rather than to affected individuals directly, meaning the deterrent is aimed squarely at organisational behaviour, not compensation.

‍

The part everyone keeps underestimating: this is not just a legal department problem

‍

Perhaps the most consequential shift buried inside the DPDP framework is who actually has to own it. Reading the Rules as a checklist for the legal or privacy team alone misses how far the obligations actually reach. Building a compliant consent lifecycle touches product design. Security safeguards touch cybersecurity and IT infrastructure directly. Retention and deletion logic touches data governance and engineering. Third party risk review touches procurement. Breach preparedness touches internal audit and incident response. And increasingly, as organisations deploy AI systems that process personal data, AI governance enters the picture too, since a model trained or fine tuned on personal data inherits the same DPDP obligations as any other processing activity.

That cross functional reality is where most readiness programmes currently fall short. Treating DPDP compliance as a documentation exercise, updating a privacy policy PDF and calling it done, produces the appearance of compliance without the operational substance a Data Protection Board investigation would actually test. A breach response plan that exists only on paper and has never been rehearsed will not hold up against the 72 hour data principal notification window the Rules impose once Phase 3 lands. A consent mechanism bolted onto a website without corresponding backend logic to honour withdrawal requests will not satisfy an actual audit.

‍

What a serious readiness posture looks like right now

‍

Organisations that are ahead of this curve are already treating the eighteen month window as three overlapping workstreams rather than one deadline to hit at the end. 

• The first is discovery: mapping what personal data exists, where it flows, who owns each system that touches it, and why it is collected in the first place, since compliance is structurally impossible without first knowing what you are protecting. This stage typically surfaces uncomfortable findings, shadow data sets nobody formally owns, vendor integrations nobody fully mapped, legacy systems still holding data well past any reasonable retention justification. 
• The second is build: standing up the actual mechanisms, consent flows that can genuinely honour a withdrawal request end to end, rights request handling that does not depend on a single overworked employee checking an inbox, retention and deletion logic wired into the systems themselves rather than described only in a policy document, and security controls proportionate to the sensitivity of what is being protected. 
• The third is proof: generating the internal evidence, audit trails, documented decisions, tested response procedures, that demonstrates governance was real rather than retrofitted after the fact. A Data Protection Board investigation, when it eventually happens, will not be satisfied by a well written policy; it will look for evidence that the policy was actually operational.

‍

The actual question worth asking

‍

The right question was never "when does DPDP become enforceable." Phase 1 already answered that; the law is live, and the Data Protection Board already exists and can act. The better question, the one worth taking into any leadership review between now and May 2027, is simpler and considerably less comfortable: will the organisation actually be ready when each phase's obligations become operational, or will readiness be assembled in a scramble once the deadline stops being theoretical. 18 months sounds long right up until the week it does not, and by the time Phase 3 lands, "we'll get to it" will no longer be a sentence any organisation gets to finish.

‍

References

1. Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, notified 13 November 2025. Press Information Bureau, "Digital Personal Data Protection Rules, 2025 Notified," 14 November 2025. https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
2. Shardul Amarchand Mangaldas & Co, "Enforcement of the DPDP Act and notification of the DPDP rules." https://www.amsshardul.com/insight/enforcement-of-the-dpdp-act-and-notification-of-the-dpdp-rules/
3. S&R Associates, "India's Digital Personal Data Protection Regime Takes Effect." https://www.snrlaw.in/indias-digital-personal-data-protection-regime-takes-effect/
4. Khurana & Khurana, "MeitY Notifies Rules Operationalising The DPDP Framework." https://www.khuranaandkhurana.com/update-meity-notifies-rules-operationalising-the-dpdp-framework-in-india
5. Exchange4media, "DPDP Act 2025: Penalties for violations can reach Rs 250 crore." https://www.exchange4media.com/digital-news/dpdp-act-2025-penalties-for-confirmed-violations-can-reach-rs-250-crore-149360.html
6. Seclore, "DPDP Rules 2025: India's Complete Compliance Guide." https://www.seclore.com/fundamentals/dpdp-rules-2025-compliance-guide/

‍