In brief
- Regulation: GDPR.
- All insurers are concerned as data controllers.
- Identify an exemption.
- Conduct a DPIA.
- Govern profiling and decisions.
- Fines of up to €20M or 4% of global turnover, with increased supervisory scrutiny on health data and profiling.
Regulatory deadlines
The key dates of this regulation.
May 2018
Entry into application
In forceWhat does GDPR cover?
The GDPR classifies health data among the special categories under Article 9, the processing of which is prohibited except where an exception applies (explicit consent, public interest, performance of an insurance contract under certain conditions). Insurers must precisely identify the exception relied upon.
Profiling and fully automated decisions producing significant effects are strictly regulated: information obligations and the right to human intervention.
Is the 'Insurance' sector affected?
All insurers are affected as data controllers. Lines handling health data (loan insurance, provident, health) bear the most stringent requirements.
Non-life insurance branches handle fewer sensitive data but remain fully subject to GDPR for pricing, claims management, and anti-fraud activities.
Detailed obligations
Identify an exception
Ground each processing of health data on a specific exception under Article 9, duly documented.
Conduct a DPIA
Conduct an impact assessment for large-scale processing of health data and for significant profiling.
Governing profiling and decisions
Inform policyholders about profiling and guarantee, for fully automated decisions with significant effects, the right to human intervention.
Control retention periods
Apply retention periods adapted to contracts and claims, then archive or delete accordingly.
Secure at a high level
Encryption, segmentation, access management and logging, commensurate with the sensitivity of the data.
Comply with sector-specific rules
Take into account national rules governing, for example, medical questionnaires.
Sanctions & risks
Fines of up to €20M or 4% of global turnover, with heightened regulatory scrutiny on health data and profiling. A breach involving pricing may also reveal non-compliance with the AI Act.
A health data breach affecting policyholders constitutes a major incident, both human and reputational.
Common mistakes in the sector
- 1Health data without exception. Processing health data without a valid exception under Article 9.
- 2Missing DPIA. Omitting the impact assessment nonetheless expected.
- 3Unregulated automated decisions. Refusing or pricing in a fully automated manner without safeguards.
- 4AI Act accumulation ignored. Treating pricing under a GDPR-only lens.
Practical case
A mortgage insurer collects health data via a questionnaire and automates part of its underwriting decisions. It bases the processing on an exception under Article 9, carries out a DPIA, informs applicants of the profiling, and provides for human intervention upon request — while taking into account national rules governing the medical questionnaire.
Compliance roadmap
- 1
Map. Mapping health data and profiling processes, and their legal bases.
- 2
Qualify and document. Verify the exception invoked and carry out the necessary DPIAs.
- 3
Govern profiling. Documenting information and safeguards on automated decisions.
- 4
Define retention periods. Set retention periods by purpose.
- 5
Secure. Strengthen security and traceability of sensitive data.
Frequently asked questions
Yes, but only on the basis of a specific exception under Article 9, with enhanced security and often a DPIA.
Take action on GDPR
Free assessment or a chat with an expert dedicated to insurance.
They already trust us
See how organisations in the insurance sector secured their compliance with DCO.