Data protection for the insurance industry

Life is full of uncertainty and people want assurances. You cannot buy certainty, but you can buy insurance. By putting your faith in another organisation and paying them a fee based on your risk, they will agree to step into your shoes and take on your burdens – should the risk materialise. This relationship is based on trust. Trust that the insurer will be ready to compensate you if the risk materialises, trust that the insured person will tell the truth when asked various questions by the insurer and trust that the insurer will protect the personal data belonging to the insured person. The personal data belonging to a policyholder, beneficiary or other data subject in the insurance industry is valuable and cybercriminals, hackers and other bad actors will do their best to get their hands on it and exploit it. It is your duty as an insurer, intermediary or other organisation processing personal data in the insurance industry to protect the personal data of your data subjects in compliance with relevant data protection laws.

Are you aware of your obligations as an organisation in insurance industry when it comes to data protection? Are you ready and able to fulfil the rights of policyholders, beneficiaries and other data subjects?

This programme tackles data protection from the perspective (or through the lens) of an organisation in the insurance industry. The insurance industry is the area of economic activity that involves agreements to protect others from financial loss if certain agreed upon risks materialise in exchange for compensation, such as motor vehicle, household, or personal insurance.

It is an information-rich industry with lots of role players and the impact of data protection laws is generally high. In South Africa for example, there is also a significant overlap between the Long and Short-Term Insurance Acts and POPIA.

What laws apply to your processing?

Relevant data protections laws apply to your processing as an organisation in the insurance industry, the GDPR in the EU, CCPA in the US state of California and POPIA in South Africa. You need to understand certain concepts related to these laws to properly comply with your obligations, including:

• Who are the role players when it comes to the insurance industry? Between the insurers themselves and the intermediaries, who is the controller and who is the processor?
• What data protection principles apply to processing as an organisation in the insurance industry?
• How should one take a global view when it comes to data protection and the insurance industry?
• What are your information security obligations as an organisation in the insurance industry?
• How should you manage your data processing relationships when it comes to other role players in the insurance industry?
• How should you tackle records retention and data governance in the insurance industry?

Will joining this lens help my organisation comply?

Yes. That is the short answer. We understand that you may be working with limited resources and budgets. We want to help you in the most efficient and cost-effective way. Our data protection lens for the insurance industry will help you. This lens combined with our practical core programme takes you through the key actions an organisation in the insurance industry must take to comply.

If you have joined one of our core programmes then you get complimentary access to this lens. This lens is for all the insurance industry and is particularly appropriate for:

• insurers;
• intermediaries; or
• other organisations processing personal data in the insurance industry.

As a direct consequence of this programme, you will:

• get an overview of how data protection laws apply to the insurance industry;
• learn how relevant data protection laws affect the relevant classes of data subject and role players for the insurance industry, such as policyholders and beneficiaries; and
• explore specific data protection pain points for the insurance industry.

• We believe in using the law as a tool to prevent harm from coming to people.
• We have significant practical experience dealing with data protection law.
• We cover only those areas of data protection law that are most relevant to you, saving you time and money.
• We provide insight and simplify the issues, empowering you to work through the obligations yourself.

You can work through this lens at your own pace and go as fast or slow as you like. Depending on the data protection processes you already have in place, it could take you a few hours or a few weeks to work through this lens.