Introduction
In this article we examine some of the duties on insurers under
the General Data Protection Regulation ("GDPR") and Data
Protection Act 2018 ("DPA") in the context of pre-action
personal injury claims.
Insurers must be careful to meet their duties under the
GDPR/DPA. There are different duties depending on whether the
insurer is considered a controller or processor with a controller
being subject to the most onerous level of compliance
responsibility. GDPR seeks to protect people with regard to the
processing of their personal data. Personal data is:
"Any information relating to an identified or
identifiable natural person ('data subject'); an
identifiable natural person is one who can be identified, directly
or indirectly, in particular by reference to an identifier such as
a name, an identification number, location data, an online
identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or
