Business insurance data protection: lawful bases and sharing

Business insurance data protection starts with mapping contact details, employment information, vehicle data, claims history, security arrangements and health information collected during a business insurance journey. A small firm arranging commercial motor or fleet cover may provide driver details and claims histories; an employers’ liability claim may involve worker injury and health information, while commercial property applications can include premises and security details. UK data-protection duties apply to personal information even where the policyholder is a company, including information identifying its directors, staff, drivers, claimants or sole traders. The governing framework is the UK GDPR and the Data Protection Act 2018 (DPA 2018): the UK GDPR sets out the Article 6 lawful bases and Article 9 conditions, while the DPA 2018 provides relevant statutory conditions.

This guide is an operational starting point, not legal advice. ICO material is being updated in places following the Data (Use and Access) Act, so reopen the relevant guidance before implementation.

What to take away

Select and document a lawful basis before using personal information, and include it in privacy information.
Special category data needs both an Article 6 basis and an Article 9 condition, sometimes with a policy document.
Tell people who receives their information and why, and log every disclosure you make.
Review data protection whenever a new insurer, field, model, tool or transfer is proposed.

Identify roles from real decisions

List the business customer, publisher, comparison service, broker, insurer, software provider, payment service and claim handler. For every organisation, ask who decides why the personal information is used and the essential means of using it.

Controller vs Processor Roles

Controller

Decides why: Yes
Decides means: Yes
Acts on instructions: No
Contract labels: Not decisive
Agreement terms: Required

Processor

Decides why: No
Decides means: No
Acts on instructions: Yes
Contract labels: Not decisive
Agreement terms: Required

The ICO's controller and processor guidance explains that controllers determine purposes and means, while processors act for a controller under its instructions. Contract labels do not settle the question when conduct shows a different role.

Record separate controllers, joint control and processor relationships. Put required terms, instructions, security and audit rights into the relevant agreements.

Choose purpose and lawful basis first

Create a processing record with the data, person, source, purpose, lawful basis, recipient, location, retention and rights process. The ICO's updated lawful-basis guide says organisations must select and document a valid basis before using personal information and include the basis and purpose in privacy information.

The six UK GDPR Article 6(1) bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. Contract applies only where processing is necessary for a contract with the data subject, or for steps requested by that person before entering a contract. Legitimate interests requires a necessity and balancing assessment; public task applies only where the organisation is carrying out a relevant public function.

Worked example: a quotation-to-claim data map for a small firm’s commercial motor (van) policy. At quote stage, name, address, vehicle registration and claims history support risk assessment and pricing; panel insurers are recipients, and the example retains the quote record for 2 years. For a sole trader who requests a quote, Article 6(1)(b) may cover steps at that person’s request; for a company employee or driver, the employer’s policy does not by itself make that person party to a contract, so assess an appropriate basis, such as legitimate interests where justified.

At claim stage, name, contact and incident details support claim handling; injury information needs an Article 9 condition as well as an Article 6 basis. A loss adjuster or medical expert may receive relevant information. Article 6(1)(b) applies only where the data subject is party to the contract; legitimate interests may be appropriate for other people’s data after an assessment, while Article 6(1)(c) applies only where processing is necessary to meet a specific legal obligation. The example retains the claim record for 7 years after settlement, not as a universal rule.

Sample notice wording: "We use your details to prepare your quote, share them with the insurers and brokers listed below, and keep quote records for 2 years."

Processing Record Fields

Data
Person
Source
Purpose
Lawful basis
Recipient
Location
Retention

Do not use one broad purpose such as insurance services for quotation, fraud prevention, claims, analytics and marketing. Test necessity for each operation. Legitimate interests is commonly considered as the Article 6 basis for fraud prevention, analytics and marketing, but it is not automatic: document a legitimate interests assessment (LIA) covering the purpose, necessity and balancing of interests. Participation in a service does not automatically provide consent for unrelated advertising.

Protect sensitive information

Health, biometric, ethnicity and other defined information may be special category data. The UK GDPR requires both an Article 6 basis and an Article 9 condition. For commercial insurance, the insurance condition is in DPA 2018 Schedule 1 Part 2 paragraph 16, under the substantial-public-interest route in Article 9(2)(g). Its statutory tests concern necessary processing for an insurance business purpose, including deciding whether to offer a contract or its terms, administering an insurance contract, and exercising rights or meeting obligations connected with it. Check the full tests against your role and purpose; this is not blanket permission for any organisation that handles health data. Prepare an appropriate policy document where the applicable condition requires one. ICO special category guidance explains the requirements.

The UK GDPR Article 9(2) conditions are not interchangeable. Identify the specific condition that applies and meet its requirements:

Explicit consent (Article 9(2)(a)).
Employment, social security or social protection rights and obligations (Article 9(2)(b)).
Vital interests, where the person is incapable of giving consent (Article 9(2)(c)).
The legitimate activities of a qualifying not-for-profit body (Article 9(2)(d)).
Information manifestly made public by the data subject (Article 9(2)(e)).
The establishment, exercise or defence of legal claims (Article 9(2)(f)).
Substantial public interest, where UK law provides a condition and safeguards; the insurance condition is one such route where its tests are met (Article 9(2)(g)).
Occupational medicine, working-capacity assessment, medical diagnosis, health or social care and related management (Article 9(2)(h)).
Public health (Article 9(2)(i)).
Archiving in the public interest, scientific or historical research, or statistical purposes (Article 9(2)(j)).

Collect only what the current step needs. Separate screening from underwriting detail, restrict free-text boxes and prevent a business contact from uploading employee medical records without a lawful, controlled purpose. Apply similarly careful analysis to criminal-offence information.

Make sharing visible and controlled

Draw the data path from first form to every insurer, intermediary, analytics service and supplier. The ICO's data-sharing code distinguishes controller-to-controller sharing from processing by a supplier. Transfers outside the UK need an adequacy regulation, the UK Extension to the EU-US Data Privacy Framework, or an International Data Transfer Agreement with a transfer risk assessment.

Tell people who receives their information and why. Do not send a full quotation record to every panel member if a smaller set can answer the stage. Log disclosures and give users a way to correct inaccurate details before submission.

Set operational controls

minimise fields and permissions;
encrypt transfer and suitable storage;
use strong authentication for staff and partners;
separate test data from live customer records;
monitor access and unusual exports;
validate deletion and backup handling;
prepare incident assessment and notification routes;
test data-subject request and correction workflows.

The example uses 2 years for quote records and 7 years after settlement for claim records. Treat these as illustrative periods, not universal legal defaults: retention should follow documented legal and business needs. The actual period depends on policy terms, limitation periods and tax rules.

Preserve records needed to explain a quotation, advice or claim, while removing duplicates and expired marketing copies under the approved schedule.

Review every change

Run data-protection review when a new insurer, form field, scoring model, enrichment source, analytics tool, marketing use or international transfer is proposed.

A data-protection impact assessment is mandatory before processing likely to result in high risk. This includes systematic and extensive profiling with significant effects, large scale use of special category or criminal offence data, and systematic monitoring of a publicly accessible area on a large scale.

Escalate automated decisions, profiling, sensitive data and unclear controller relationships.

The final release record should show the purpose, basis, notice, recipient, contract, security owner, retention and rights route for each personal-data flow. If one field has no defensible purpose and owner, remove it before launch.

Before you act

Record roles as controller, joint controller or processor.
Document a lawful basis for each separate purpose.
Check Article 9 conditions for health and other sensitive data.
Log disclosures and let users correct details before submission.
Run a review for every new field, tool or transfer.

Common questions

How do I work out whether my organisation is a controller or a processor?

Ask who decides why the personal information is used and the essential means of using it. The ICO guidance says controllers determine purposes and means, while processors act for a controller under its instructions. Contract labels do not settle the question when conduct shows a different role, so record separate controllers, joint control and processor relationships.

Can I rely on one lawful basis for quotation, fraud prevention, claims, analytics and marketing?

No. Do not use one broad purpose such as insurance services for all of these. Test necessity for each operation and document a valid basis before using personal information. Participation in a service does not automatically provide consent for unrelated advertising, so each purpose needs its own assessment.

What must I do before sharing personal data with insurers and suppliers?

Draw the data path from the first form to every insurer, intermediary, analytics service and supplier. Tell people who receives their information and why. Do not send a full quotation record to every panel member if a smaller set can answer the stage. Log disclosures and give users a way to correct inaccurate details before submission.

ICO note: Parts of the data-sharing code are marked under review; record this in the compliance log.