Insurance data rules get an update
California signed SB 354, the Insurance Information and Privacy Protection Act, as part of the package announced September 30. The insurance department says the law updates privacy protections that are more than 40 years old, addressing how insurers and third parties collect, use and share personal information.
The department describes increased transparency and accountability for insurance information. This is a sector-specific law announcement, not a cash settlement or proof that an individual insurer has breached a customer record. It should not be confused with a claim form offering compensation for past conduct.
The timetable matters as much as the headline
The new law begins taking effect July 1, 2028. The summary also describes a five-year implementation period for licensee record-retention and deletion policies. Specified compliance provisions extend to agents, brokers and wholesale intermediaries starting January 1, 2029.
Those dates mean a September 2026 signature is not immediate implementation of the whole framework. Consumers comparing privacy notices should separate existing rights from provisions still in transition. Ask about the insurer current data practices, and use the applicable law and date rather than assuming the new act already changes every retention rule.