Specialized GDPR Compliance for Insurance Companies

GDPR Insurance: Data Protection for the Insurance Sector

Insurance companies process particularly sensitive personal data — from health data and creditworthiness information to risk profiles.

  • 01Legal basis analysis for health data, scoring and profiling under Art. 6 and Art. 9 GDPR
  • 02Data Protection Impact Assessment (DPIA) and deletion concepts considering insurance retention obligations
  • 03Implementation of insurance industry codes of conduct under Art. 40 GDPR
  • 04GDPR-compliant data processing agreements with reinsurers, IT providers and claims adjusters
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

Data Protection in the Insurance Sector: Implementing GDPR Requirements for Insurers

Insurance companies process particularly sensitive personal data: health data under Art. 9 GDPR, creditworthiness information and risk profiles. The GDPR therefore places high requirements on the insurance sector — from legal bases through consent management to data protection impact assessments. We help insurers implement all GDPR obligations so that data protection is legally compliant, practical and efficiently organized.

We advise insurance companies on complete GDPR implementation: from legal basis analysis through records of processing activities to implementing deletion and retention concepts. We consider industry-specific requirements such as insurance codes of conduct and supervisory guidelines.

6 service modules

What we take on for you

Bookable individually or as an end-to-end programme.

01

GDPR Legal Bases and Consent Management

We analyze the legal bases for your data processing and develop practical consent management — from application through to claims assessment.

  • Legal basis analysis for health data, creditworthiness data and risk profiles under Art. 6 and Art. 9 GDPR
  • GDPR-compliant design of consent forms and confidentiality waivers
  • Purpose limitation and data minimization across all processing operations
  • Documentation of legal bases in the records of processing activities
02

Data Protection Impact Assessment and Scoring Compliance

We conduct DPIAs for your scoring, profiling and automated decision-making procedures and ensure conformity with Art. 35 GDPR.

  • DPIA for risk scoring, creditworthiness assessment and automated pricing
  • Proportionality assessment and documentation of safeguards
  • Ensuring human review for automated decisions under Art. 22 GDPR
  • Consultation with the supervisory authority where high residual risk remains
03

Deletion Concept and Retention Periods

We develop a differentiated deletion concept that reconciles insurance retention obligations with the GDPR storage limitation principle.

  • Categorization of all data types with applicable retention periods from commercial, tax and insurance law
  • Blocking and deletion concept for policyholder data, claims data and health data
  • Technical implementation of automated deletion routines in policy administration systems
  • Alignment with industry code of conduct retention period guidance
04

Data Processing Agreements and Third-Country Transfers

We structure your contracts with IT providers, claims adjusters and reinsurers for GDPR compliance and secure international data transfers.

  • Data processing agreements (DPA) under Art. 28 GDPR for all service providers
  • Review of technical and organizational measures (TOMs) at processors
  • Third-country transfer safeguards with Standard Contractual Clauses under Art. 46 GDPR
  • Audit framework and regular processor compliance monitoring
05

Data Protection Officer and Training

We support the establishment or strengthening of your DPO function and train your staff in handling sensitive insurance data.

  • DPO setup and training under Art. 37–39 GDPR
  • Staff training on GDPR-compliant handling of sensitive insurance data
  • Preparation for audits by data protection authorities and insurance supervisors
  • Breach notification process: meeting the 72-hour deadline under Art. 33 GDPR
06

Insurance Industry Codes of Conduct

We guide you through implementing industry codes of conduct under Art. 40 GDPR and ensuring conformity with insurance-specific data protection standards.

  • Implementation of industry code of conduct requirements in your organization
  • Integration of insurance IT supervision requirements into your data protection concept
  • Privacy-by-design integration into insurance IT systems and application processes
  • Demonstrating industry compliance to supervisory authorities

5 phases

Our Consulting Approach for GDPR Compliance in the Insurance Sector

Together with you, we develop a tailored data protection concept that aligns GDPR requirements with industry-specific regulations from insurance supervision law and codes of conduct — practical, legally compliant and audit-ready.

  1. GDPR maturity assessment and gap analysis of your existing data protection organization

  2. Design of an insurance-specific data protection framework covering all legal bases

  3. Implementation involving all business areas — from application processing to claims handling

  4. Integration into existing policy administration systems and application processes (privacy by design)

  5. Step 5

    Ongoing monitoring, training and preparation for audits by data protection authorities and insurance supervisors

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn

Why ADVISORI for Data Protection in the Insurance Sector

  • 01Experience with GDPR projects at primary insurers, reinsurers and InsurTechs
  • 02Proven methodology combining data protection law and insurance regulation
  • 03Industry expertise in health data, scoring and cross-border data transfers
  • 04Implementation-oriented consulting: from concept through implementation to supervisory audits

Health Data Requires Enhanced Safeguards

Insurers processing health data under Art. 9 GDPR need explicit consent or a statutory legal basis. Violations are sanctioned with fines up to EUR 20 million or 4% of annual turnover. A Data Protection Impact Assessment (DPIA) is mandatory for scoring, profiling and automated decision-making.

7 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about GDPR Insurance Sector

What GDPR requirements apply specifically to insurance companies?

Insurance companies must meet special requirements beyond the general GDPR obligations because they regularly process sensitive personal data. Key requirements include:

• Legal basis under Art. 6 and Art. 9 GDPR: Processing health data, creditworthiness information and risk profiles requires either explicit consent or a statutory legal basis.
• Data Protection Impact Assessment (DPIA): Automated scoring and profiling procedures for risk assessment require a DPIA under Art. 35 GDPR.
• Records of processing activities: Insurers must document all data processing operations — from application processing through claims assessment to fraud detection.
• Breach notification: Data breaches must be reported to the supervisory authority within 72 hours (Art. 33 GDPR).
• Industry codes of conduct: Sector-specific codes under Art. 40 GDPR specify requirements for the insurance industry.

How may insurers process health data under the GDPR?

Health data is specially protected under Art. 9 GDPR. Insurers may only process it when one of the following conditions is met:

• Explicit consent of the policyholder (Art. 9(2)(a) GDPR) — consent must be freely given, informed and revocable.
• Necessity for contract performance: In health and life insurance, health assessments are necessary for risk evaluation and pricing.
• Statutory legal basis: National insurance laws may permit the collection and processing of health data to the extent required for risk assessment or claims processing.

Important: Data may only be used for the specified purpose and must be deleted once the processing purpose ceases. Disclosure to third parties (e.g. reinsurers) requires its own legal basis and transparent information to the data subject.

What is an insurance industry code of conduct under Art. 40 GDPR?

Industry codes of conduct under Art. 40 GDPR specify the general GDPR requirements for the insurance sector. They typically cover:

• Data collection and processing: The code defines what data insurers may collect, for what purpose and how data minimization is implemented.
• Transparency obligations: Insurers must inform policyholders about data processing, including profiling and scoring.
• Retention periods: The code defines industry-specific retention periods and deletion concepts.
• Supervision: Compliance is monitored by an independent body.

For participating insurers, the code is binding and simultaneously serves as evidence to supervisory authorities that industry-specific best practices are being followed.

When is a DPIA mandatory for insurance companies?

A DPIA under Art. 35 GDPR is mandatory for insurance companies whenever data processing is likely to result in a high risk to the rights and freedoms of data subjects. Typical cases in the insurance sector include:

• Scoring and profiling: Automated assessment of creditworthiness or insurance risk based on personal characteristics.
• Health data processing: Systematic processing of health data in health or life insurance.
• Fraud detection: Automated systems that detect insurance fraud based on patterns and anomalies.
• Big data analytics: Analysis of large datasets for pricing optimization or risk selection.

The DPIA must be conducted before processing begins and documents the risks, planned safeguards and proportionality assessment. Where a high residual risk remains, consultation with the supervisory authority is required.

What role does the Data Protection Officer play at insurance companies?

Insurance companies are generally required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR because they process special categories of personal data on a large scale.

The DPO handles the following tasks:

• GDPR compliance monitoring: Oversight of all data processing operations — from application through claims handling.
• Advisory: Support with data protection impact assessments, introduction of new IT systems and design of consent forms.
• Training: Raising employee awareness for handling policyholder data.
• Contact point: Point of contact for data subjects exercising their rights to access, rectification or erasure.
• Authority liaison: Interface with the data protection supervisory authority for audits and notifications.

The DPO must be able to act independently and may not be disadvantaged because of their role.

How do insurers implement GDPR-compliant deletion concepts?

A GDPR-compliant deletion concept is particularly complex for insurers because various retention obligations from insurance law, commercial law and tax regulations must be considered:

• Data categorization: Policyholder data, claims data, health data and marketing data require different retention periods.
• Retention obligations: Contract data typically must be retained for 10 years after contract termination, while health data from claims assessments may have shorter periods.
• Blocking instead of immediate deletion: Where statutory retention obligations apply, data is blocked and deleted after the period expires.
• Technical implementation: Automated deletion routines in policy administration systems ensure deadlines are met.
• Documentation: Every deletion process must be traceably documented.

Industry codes of conduct contain sector-specific recommendations on retention periods that serve as guidance.

What must insurers consider when working with data processors?

Insurance companies work with numerous external service providers — from IT providers through claims adjusters to reinsurers. The GDPR sets clear requirements:

• Data processing agreement (DPA) under Art. 28 GDPR: Every service provider processing personal data on behalf of the insurer needs a written DPA with defined instructions, security measures and deletion obligations.
• Careful selection: Insurers must verify that the processor ensures adequate technical and organizational measures (TOMs) under Art. 32 GDPR.
• Subprocessors: Use of subprocessors requires the insurer’s approval and must be contractually regulated.
• Third-country transfers: Transfers to service providers outside the EEA require additional safeguards (e.g. Standard Contractual Clauses under Art. 46 GDPR).
• Regular monitoring: Insurers must verify compliance with agreed measures through audits or reports (e.g. SOC 2, ISO 27001).

Certificates, partners and more

ISO 9001 CertifiedISO 27001 CertifiedISO 14001 CertifiedBeyondTrust PartnerBVMW Bundesverband MitgliedMitigant PartnerGoogle PartnerTop 100 InnovatorMicrosoft AzureAmazon Web Services

Your strategic success starts here

Our clients trust our expertise in digital transformation, compliance, and risk management

Ready for the next step?

Schedule a strategic consultation with our experts now

30 Minutes • Non-binding • Immediately available

For optimal preparation of your strategy session:

Your strategic goals and challenges
Desired business outcomes and ROI expectations
Current compliance and risk situation
Stakeholders and decision-makers in the project

Prefer direct contact?

Direct hotline for decision-makers

Strategic inquiries via email

Detailed Project Inquiry

For complex inquiries or if you want to provide specific information in advance