Outsourcing risk management requires IIOs to protect policyholder interests, maintain oversight, preserve data privacy, and use confidentiality safeguards.

Every IIO must manage outsourcing risks prudently to prevent adverse systemic effects and protect policyholder interests. Outsourced activities require effective oversight, responsive management practices, adequate due diligence and protection of policyholder data privacy. Before sharing policyholder-related data, an IIO must execute a non-disclosure agreement with the outsourcing agency or include equivalent confidentiality provisions in the service level agreement. Further outsourcing requirements may be specified by the Authority.

---

---

---