Skip to main content

Privacy Policy- India

Last updated July 2026

Where Milliman is Acting as a Data Fiduciary

Milliman, Inc. and its affiliates (“Milliman” or “we”) take data privacy very seriously. This Privacy Policy sets out the principles governing the Indian affiliates’ (Milliman India Private Ltd and Milliman Advisors LLP) use and protection of personal data that individuals and clients residing within India share with us (“Personal Data”), hereafter “you”. For the purposes of India’s Digital Personal Data Protection Act, 2023 and the rules issued thereunder (“DPDP Laws”), Milliman may act as a Data Fiduciary where it determines the purpose and means of processing digital Personal Data. Milliman is committed to handling Personal Data in accordance with this Privacy Policy, the DPDP Laws, and other applicable data protection and privacy laws.

Milliman, Inc. and the Milliman Indian affiliates are Data Fiduciaries with respect to the processing of Personal Data described in this Privacy Policy. Where the DPDP Laws apply, Milliman, Inc. and the Milliman Indian affiliates may be treated as Data Fiduciaries to the extent they determine the purpose and means of processing Personal Data. This means that Milliman, Inc. and the Milliman Indian affiliates are each responsible for compliance with applicable data protection laws. Milliman Sàrl (France) will be considered as a Data Fiduciary only in such cases where a Data Principal exercises their rights by using a data privacy request platform under the control of Milliman Sàrl (France).

Collection of Data

Aggregate Data

Like many companies, Milliman monitors the use of its websites by collecting aggregate data. No Personal Data is collected in this process. Typically, Milliman collects data about the number of visitors to the website, to each web page, and the originating domain name of the visitor's Internet Service Provider. This data is used to improve the usability, performance and effectiveness of Milliman’s website.

Cookies, Third-Party Embedded Content and Do Not Track

For more detailed information describing how Milliman uses cookies and your choices surrounding the use and opt out of such cookies, including information about third party embedded content on Milliman’s website and how Milliman responds to Do Not Track signals in browsers, please review our Cookie Policy which can be found here.

Processing of Personal Data

The Personal Data we collect varies depending upon the nature of the services provided and our interactions with individuals. In the context of the collection of data through this website, Milliman’s marketing activities, contract administration, and due diligence (Know Your Customer (“KYC”) processes), we may collect, store and otherwise process Personal Data of:

- visitors to our websites (first name, last name, title, company, phone number, location, email address, subject of the request and message given) who request information about products or services from Milliman, for the purpose of the management of the relationship with clients and the administration of the website. The legal basis for the processing of Personal Data is legitimate use, where permitted by applicable law.

- clients’ representatives, officers, agents and employees, business partners, providers, parties to a contract (name, professional address, title, email and other professional contact details) for contract administration purposes. The professional contact details of clients’ representatives, their employees and business partners are also used to activate and maintain client accounts, including for billing purposes, due diligence, Know Your Customer (KYC), conflict checks, Client Relationship Management (CRM), IT maintenance and security, data privacy (management of Data Principals’ requests), to fulfil requests or respond to inquiries about Milliman products or services, and to provide offers and information (as permitted by law) about products, services, or events offered by Milliman or that Milliman thinks may be of interest. We will process Personal Data only for lawful purposes and on a valid ground, including legitimate use or other permitted uses under law. Milliman may rely on your consent for the sending of marketing communications when required by data protection and privacy laws, in which case we will ask your consent prior to the sending of the communication. The Milliman Indian affiliates may also use professional contact details of their clients’ employees for the purpose of sending surveys, questionnaires or for the purpose of organizing contests. For those activities, the legal basis for the processing of Personal Data is legitimate use unless data protection and privacy laws require your prior consent. We may also collect and process limited Personal Data about you from public resources (such as LinkedIn) which may include your name/surname, email address, telephone number, organization, title/position, profession, professional interests, which we use to assess a potential interest in our services and to contact you for marketing purposes. Where necessary and legally allowed for compliance and due diligence purposes, we may also collect, through third-party screening services acting as independent Data Fiduciaries, certain publicly available background information relevant to know-your-client (KYC) checks, such as information relating to legal or regulatory matters, sanctions screening, and media reporting.

When we communicate with you regarding the products and services we offer or develop, you will be given the opportunity in each communication to unsubscribe and prevent future communications of that sort. If you do not want us to collect this information from our marketing emails, or if you wish to unsubscribe from direct marketing communications from us, you may make a data privacy request following the instructions under the section “Rights”. We will cease using your Personal Data for direct marketing purposes once you have requested us to do so.

If you provide us with Personal Data of another individual, it is your duty to make sure that these individuals have consented to or are appropriately informed about the processing of their Personal Data by Milliman.

No automated decision-making is undertaken based on the Personal Data collected from you.

Affiliates and Authorized Third-Party Agents

All Milliman websites, products, and services are provided in cooperation with Milliman, Inc., located in the U.S. Any Personal Data may be shared between Milliman’s Indian affiliates and Milliman, Inc., or other entities controlled by or under common control with Milliman, Inc., for purposes of centralization of Milliman’s General Corporate Services including: administrative services, contract management, including for billing purposes, due diligence, Know Your Customer (KYC), conflict checks, Client Relationship Management (CRM), IT maintenance and security, data privacy (management of Data Principals’ requests) and marketing services (cookie management, inquiry tracking via Milliman’s website form, communication regarding Milliman’s products, services, or events).

We may also share Personal Data with affiliated entities using the MILLIMAN® mark, in which case we will require those affiliates to comply with this Privacy Policy. Please note that we may be transferring your Personal Data to a country that does not have the same data protection laws as your home country. Where the DPDP Laws apply, cross-border transfers of digital Personal Data will be undertaken in accordance with applicable legal requirements, including any restrictions or conditions notified by the Government of India. However, Milliman ensures that it and its affiliates will process Personal Data in compliance with this Privacy Policy.

Milliman also may share Personal Data with authorized third-party agents or contractors that perform services for Milliman. If Milliman shares Personal Data with a third party, Milliman requires that those third parties agree to process Personal Data based on Milliman’s instructions and in compliance with this Privacy Policy.

For transfers of Personal Data outside India, Milliman will apply safeguards and contractual or organizational measures designed to protect Personal Data in accordance with applicable data protection and privacy laws, including the DPDP Laws where applicable. Additional information may be made available by contacting us at [email protected].

Other Disclosures

Milliman may also disclose Personal Data and other related information in response to subpoenas, court orders, or other lawful requests by public authorities, and to meet national security or law enforcement requirements. Milliman may collect and share Personal Data in order to investigate or take action regarding illegal activities, suspected fraud, violations of Milliman's Terms of Use, or as otherwise required by law or regulation.

Security

Milliman stores Personal Data on a secure server that is password protected and shielded from unauthorized access by a firewall. Milliman has in place security policies that are intended to ensure the security and integrity of all Personal Data. Milliman has appropriate technical and organisational measures in place to protect against unauthorised or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data held or processed by Milliman. If Milliman forwards Personal Data to any third party, Milliman requires that those third parties have appropriate technical and organisational measures in place to comply with this Privacy Policy and applicable laws.

Data Retention

Milliman retains Personal Data only as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or not prohibited by law. Milliman will delete your Personal Data once the purpose of the collection and processing of such Personal Data has been fulfilled and the adequate duration for documentation and backup storage of such Personal Data has lapsed. If you have unsubscribed from receiving marketing information from us, we will continue to maintain your Personal Data for any other purpose for which we still have legal grounds for processing such Personal Data (such as for the purposes of complying with a legal obligation or when the processing is necessary for the purpose of our legitimate use). In certain cases, if no other legal grounds exist, we will maintain limited Personal Data (such as your email address) about you on record, so as to be able to ensure for the future that such marketing communications are no longer sent to you.

Children

Milliman’s websites, products, and services are not directed to children, and Milliman does not knowingly collect Personal Data from children. If a parent or legal guardian becomes aware that his or her child has provided Milliman with Personal Data without their consent, the parent or legal guardian should contact Milliman at [email protected], and Milliman will take steps to delete any such Personal Data.

Third-party Links

Milliman’ website may contain links to websites hosted and operated by companies other than us (“Third-Party Websites”) to which you can export (part of) your Personal Data.

We do not disclose your Personal Data to these Third-Party Websites without your consent. Note that any information you disclose to Third-Party Websites is no longer under our control and no longer subject to this Data Privacy Policy.

You should review the privacy policy practices of any such Third-Party Website to understand how that Third-Party Website collects and uses your Personal Data should you have decided to disclose your Personal Data to them. We are not responsible for the content or performance of these Third-Party Websites. We are in no way responsible or liable for the manner in which a Third-Party Website treats any Personal Data that you choose to provide to such a Third-Party Website and use of Third-Party Websites is strictly at your own risk.

Policy Updates

Milliman may change its Privacy Policy from time to time. Milliman therefore asks all persons concerned to check it occasionally to ensure that they are aware of the most recent version.

Rights

You have the following rights under applicable Indian data privacy laws, including the DPDP Laws where applicable, in relation to your Personal Data, namely:

  1. the right of access: you have the right to obtain from us confirmation as to whether or not Personal Data concerning you is being processed, and, where that is the case, access to (including by obtaining a copy of) such Personal Data and the manner in which, and the purposes for which we process your Personal Data, so that you can verify its accuracy and the lawfulness of the processing.
  2. the right to rectification: you have the right to obtain from us the rectification of inaccurate Personal Data concerning you, and the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
  3. the right to erasure: you may request erasure of Personal Data where the purpose of processing is no longer served, consent is withdrawn, or erasure is otherwise required under applicable law, subject to retention required or permitted by law.
  4. the right of grievance redressal: you may raise a grievance regarding the processing of your Personal Data through the contact details provided in this Privacy Policy.
  5. the right to nominate: where applicable under the DPDP Laws, you may nominate another individual to exercise your rights in the event of your death or incapacity.
  6. the right to withdraw consent: where processing is based on consent, you may withdraw consent using the mechanism made available to you. Withdrawal of consent will not affect processing undertaken before such withdrawal.

Please note that any processing of your Personal Data prior to the deletion of your account with us, your withdrawal of consent, or your request that we no longer contact you for direct marketing purposes will remain valid under the legal grounds then prevailing.

You can exercise any of your rights as stated above by reviewing the instructions on our How to Submit a Data Privacy Request page. We will endeavor to respond to any such request as soon as possible, and in any event within the timeline prescribed under the applicable laws. If you are not satisfied with the resolution of your grievance, you may have the right to approach the Data Protection Board of India in accordance with applicable DPDP Laws.

How to Contact Us

If you have any complaint or queries regarding the handling of your Personal Data, you may contact us at [email protected].