View source for Definition:General Data Protection Regulation (GDPR)

🔒 '''General Data Protection Regulation (GDPR)''' is the European Union's comprehensive data privacy framework that profoundly shapes how insurers and [[Definition:Insurtech | insurtechs]] collect, store, process, and share personal data. Because insurance is fundamentally a data-intensive business — relying on detailed personal, medical, financial, and behavioral information to [[Definition:Underwriting | underwrite]] risks, price [[Definition:Insurance policy | policies]], and settle [[Definition:Insurance claim | claims]] — GDPR imposes particularly significant compliance obligations on carriers, [[Definition:Insurance broker | brokers]], [[Definition:Third-party administrator (TPA) | third-party administrators]], and technology vendors operating in or serving EU markets. Any organization that handles the personal data of EU residents falls within scope, regardless of where that organization is headquartered, making GDPR a global concern for multinational insurers and [[Definition:Reinsurance | reinsurers]].

⚙️ Under GDPR, insurers must establish a lawful basis for every data processing activity — whether that is the performance of a contract, legitimate interest, or explicit consent. For sensitive categories such as health data used in [[Definition:Life insurance | life]] or [[Definition:Health insurance | health insurance]] underwriting, the regulation demands heightened safeguards and often requires explicit policyholder consent. Insurers must implement data protection impact assessments when deploying new technologies like [[Definition:Predictive analytics | predictive analytics]] or [[Definition:Artificial intelligence (AI) | AI]]-driven [[Definition:Claims management | claims]] triage systems. The regulation also grants policyholders rights to access, rectify, port, and request deletion of their data — rights that can create friction with insurers' obligations to retain records for [[Definition:Regulatory compliance | regulatory]] and [[Definition:Reserving | reserving]] purposes. Penalties for non-compliance can reach €20 million or 4% of global annual revenue, whichever is higher, giving the regulation real enforcement teeth.

🌍 The regulation's ripple effects extend well beyond the EU, as many jurisdictions have modeled their own privacy laws on GDPR principles, creating a patchwork of obligations that global insurers must navigate. For [[Definition:Insurtech | insurtech]] companies leveraging [[Definition:Telematics | telematics]], wearable device data, or [[Definition:Open insurance | open insurance]] APIs, GDPR compliance is not merely a legal checkbox — it is a foundational design constraint that shapes product architecture, data partnerships, and customer experience. Insurers that embed privacy-by-design principles into their operations often find that the discipline strengthens customer trust and creates competitive differentiation, particularly as consumers grow increasingly aware of how their data is used in [[Definition:Risk assessment | risk assessment]] and [[Definition:Premium | pricing]] decisions.

'''Related concepts'''
{{Div col|colwidth=20em}}
* [[Definition:Regulatory compliance]]
* [[Definition:Data privacy]]
* [[Definition:Insurtech]]
* [[Definition:Cyber insurance]]
* [[Definition:Open insurance]]
* [[Definition:Know your customer (KYC)]]
{{Div col end}}