GDPR and Client Data: What an Insurance Agent Needs to Sort Out

The first question every agent needs to ask is what role they play when processing personal data. The answer determines the scope of their responsibility.

Controller

A controller is whoever determines the purposes and means of processing. When a self-employed agent or broker keeps their own client database, deciding for themselves what data to collect, how long to keep it and what tools to use, they are the controller. This means they bear responsibility for the lawfulness of processing, for informing individuals, and for data security.

Processor

A processor processes data on the controller's instructions. When an agent works exclusively within an insurance provider's system and under its instructions, they may be considered a processor. In practice, a mixed situation is common: the agent is a processor within the insurance provider's system, but a controller in their own records.

Why the distinction matters

As a controller, you must:

• have a legal basis for every type of processing,
• inform clients about how their data is processed,
• keep a record of processing activities,
• set retention periods,
• put appropriate security measures in place,
• respond to individuals' requests regarding their rights,
• have contracts in place with all of your processors.

Using a third-party tool doesn't shift responsibility onto the provider. Responsibility stays with you; the provider is accountable to you under a contract.

The mistaken belief that consent is needed for every kind of processing leads to two problems: unnecessary forms, and a false sense that a signature means everything is in order.

Performance of a contract

Data needed to prepare a quote, arrange a policy and service it is processed on the basis of the contractual relationship, or steps taken prior to entering into a contract. Consent isn't required here, and is actually inappropriate, since it's revocable, while the processing itself doesn't really depend on the individual's will, but on the contract.

Legal obligation

Some processing stems from insurance regulation, anti-money-laundering rules, and accounting record-retention requirements. Consent isn't the basis here either.

Legitimate interest

Some processing, such as keeping a log of contacts for portfolio management purposes, can be justified on the basis of legitimate interest. This basis requires an assessment of whether that interest outweighs the individual's expectations, and it must be documented.

Consent

Consent is mainly needed for:

• direct marketing by email, phone or messages,
• processing health data, when no other basis applies,
• sharing data with third parties, when this isn't necessary to perform the contract.

Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes are not consent. Nor should consent be made a condition for taking out a policy when it isn't actually needed for that purpose.

Special categories of data

Health data is a special category of personal data. With life and health insurance it's unavoidable, so stricter rules apply: separate storage, restricted access and an explicit basis. Practical advice: don't store health data in general client notes.

Every piece of data you collect is an obligation. Data you don't hold can't leak, can't be wrong, and doesn't need to be protected.

What you always need

• name and surname, address, contact details,
• data needed to identify the policy (number, product, insurance provider),
• data the insurance provider requires to arrange the policy.

What's useful and acceptable

• notes on business communication: when, about what, what was agreed,
• information about existing insurance with other providers, when relevant to advice,
• business-relevant circumstances, such as buying a vehicle or property.

What not to log

• personal opinions and value judgements about a client,
• health details in free-text notes,
• information about family members who aren't clients, without a need,
• copies of identity documents, when there's no explicit basis for them.

A simple test: if you showed the note to the client, would it be uncomfortable? If the answer is yes, it doesn't belong in your records.

Records of processing activities

Even smaller controllers should keep a simple record: which categories of data you process, for what purpose, on what basis, who has access, who the data is shared with, and what the retention period is. A two-page document is usually enough in practice, and it's the first piece of evidence of compliance in the event of a review.

Data may not be kept indefinitely "just in case." The period must be defined and justified.

How to set the period

The period is tied to the purpose. Once the purpose ends, so does the basis for retention, unless another obligation exists:

• While a policy is active: data is needed to service the contract.
• After a policy ends: retention is justified by the statute of limitations on any claims arising from the relationship.
• Accounting records: subject to the period set by tax and accounting rules.
• Marketing notes: kept only until consent is withdrawn or the interest ends.

What to do once the period expires

Delete or anonymize the data. Anonymization means the individual can no longer be identified – even by cross-referencing with other data. Partial anonymization, where a name remains, is not anonymization.

A practical process

1. Review your client records for policies with no active status once a year.
2. Check whether a basis for retention still exists for each group.
3. Remove anything without a basis – including from backups and old files on your computer.
4. Log the process with a date.

The most common mistake in practice isn't over-collection, but forgotten old files: exports, email attachments and spreadsheet copies left on the desktop.

Any tool that holds your clients' data means someone else is processing that data on your behalf. That relationship needs to be documented.

What you need in place

• A data processing agreement with the provider.
• Information on where processing takes place and on any transfers outside your regulatory area.
• A list of any sub-processors the provider uses.
• A way to export and delete data when you stop using the service.

Questions to ask before adopting a tool

1. Which of my clients' data does the tool store in its own database?
2. Is the data encrypted, and who inside the provider's organization can access it?
3. Where are the servers located?
4. What happens to my data once I stop subscribing, and within what timeframe is it deleted?
5. Has the provider had a security incident before, and how was it handled?

An approach that reduces risk

Less data at the provider means less risk. Some solutions never move the content of your business data into the provider's database at all: client, policy and commission data stays in your own Google documents, and the application reads it on the fly and displays it in processed form, storing only settings, calculation rules and metadata you enter yourself in its own database.

Commission Clarity is built on this principle. The advantage isn't only legal: if you decide to stop using it, your data stays exactly where it always was, and no migration is needed.

Security measures need to be proportionate to the risk. For a self-employed agent, the set of measures is manageable and can be put in place in a single afternoon.

The basic set

• Two-factor authentication for email and any accounts through which client data can be accessed.
• Different, long passwords, stored in a password manager, not unprotected in a browser.
• Disk encryption on your laptop. A stolen laptop without encryption means your entire database is exposed.
• Automatic screen lock on your phone and computer.
• Limited document sharing. A link shared as "anyone with the link" is the most common cause of accidental exposure; use access by individual address instead.
• Regular backups, with a test to confirm restoration actually works.
• A separate work and personal account.

Measures for fieldwork

• Don't leave documents in your car.
• Don't access your database over public networks without a secure connection.
• A phone screen visible in a waiting room is also a source of exposure.

What to do in the event of an incident

If a data breach occurs – a lost phone, an email with personal data sent to the wrong person, unauthorized access – you need to assess the risk to the individuals concerned. Where the risk is likely, the incident must be reported to your regulator within the required timeframe, and where the risk is high, the affected individuals must also be notified. It's therefore worth preparing a short procedure in advance: who gets notified, what gets logged, who drafts the notice.

A documented incident, handled quickly and transparently, is a far smaller problem than one that's kept quiet.

These examples are illustrative. They show typical situations where data protection requirements meet an agent's everyday work, and they aren't legal advice for any specific case.

Case 1: A client's request to delete their data

Starting point. A former client, whose policy expired two years ago, requests the deletion of all their data.

What needed to be checked. The right to erasure isn't absolute. Data you must retain due to legal obligations or potential claims from a concluded contract isn't deleted. Data kept purely for marketing purposes, however, is deleted immediately.

How it was resolved. Marketing records and contact details used for notifications were removed from the records, while data tied to concluded contracts was kept until the statutory retention periods expired. The client received a written response explaining what was deleted, what remained, and why.

The point of this case: the right response to a deletion request is to split the data by purpose, not to delete everything or refuse everything.

Case 2: Client data in a personal messaging app

Starting point. An agent exchanged photos of documents with a client through a regular messaging app, with copies left in the phone's photo gallery and in an automatic cloud backup.

Why this was a problem. Identity documents ended up stored in places outside the agent's control, with no retention period and no record of who had access. If the phone were lost, it wouldn't be clear which data had been exposed.

What was fixed. A single, access-restricted space for client documents was introduced, photos were deleted from the gallery after transfer, and the device was set up with a screen lock and encryption. The messaging app remained in use for communication, but without sending document photos.

Result. The data became traceable and deletable, which is a precondition for fulfilling any client request.

The point of this case: the biggest risk for a self-employed agent isn't system breaches, but copies of data sitting in places no one thinks about.

Individuals have rights that you need to know how to fulfil. In practice, requests are rare, but when they come in, speed and organization matter.

The most common rights

• Access to data. A client can request a copy of the data you hold about them.
• Rectification. Incorrect data must be corrected without delay.
• Erasure. Applicable when there's no other basis for retention. With an active policy, erasure generally isn't possible.
• Objection to marketing. This objection is unconditional – marketing communications must stop once raised.
• Portability. Data an individual has provided themselves is, on request, provided to them in a structured format.

How to prepare

1. Know where all the data about a given client is. If it's scattered across five files, meeting the deadline will be hard.
2. Prepare a response template so you don't have to write one from scratch each time.
3. Keep a record of requests received and the dates you responded.
4. Respect the deadline set by the regulation; the response should be free of charge.

Informing clients

When you collect data, you must inform clients who you are, for what purpose you process their data, on what basis, how long you keep it, who you share it with, and what rights they have. The easiest way to handle this is with a one-page notice attached to the quote, and a privacy policy published on your website.

Well-organized data protection isn't just a legal obligation, it's a selling point. A client who sees you handling their data carefully will find it easier to trust you with their financial decisions too.