GDPR guidance for insurance websites

Insurance journeys collect more sensitive information than most commercial websites, and they usually collect it before the customer has decided to buy anything. That combination is why data protection findings cluster in the same three places: the medical declaration, the privacy information and the cookie banner.

This guide covers what to look for. It is not legal advice.

Health information at quote stage

Medical declarations, pre-existing condition questions and screening tools all collect health data, which is special category data under the UK GDPR and the GDPR. Two questions need answers on the page where the data is collected, not only in the privacy notice:

1. Why is this being collected? A short, specific purpose: assessing the risk and pricing the policy.
2. What permits processing it? Special category data needs a condition in addition to a lawful basis. For insurance this is frequently a substantial public interest condition, but the correct answer depends on your circumstances.

Vague recipients are the other common finding. "We may share your answers with our partners" does not tell the customer who receives their health information. Naming categories of recipient, such as the underwriting insurer and a medical screening provider, is clearer and easier to evidence.

Privacy information placement

Articles 13 and 14 set out what has to be provided and when. On a website, the practical test is whether the information is available at the point of collection, in a form the customer can reasonably read.

Checks worth running:

• Is there a link to privacy information from every form, including quick-quote widgets?
• Does the notice cover retention periods, international transfers and the source of data obtained from third parties such as credit reference or claims databases?
• If automated decision-making or profiling affects pricing or acceptance, is that explained?
• Are the routes for exercising rights, and the identity of the controller, easy to find?

Cookie consent

Non-essential cookies and similar technologies need consent before they are set. On insurance sites the recurring problems are practical rather than legal:

• Analytics or advertising tags fire on page load, before the banner is answered.
• The banner offers "Accept all" prominently but hides rejection behind a second screen.
• Consent is not recorded, so there is no evidence of what was agreed.
• Tag containers are updated by marketing teams without a review step, so new tags arrive outside the consent logic.

A quarterly review of what actually loads on the page, rather than what the tag inventory says should load, tends to be more revealing than a policy review.

Marketing consent and quote abandonment

Quote abandonment emails are a frequent source of complaints because the customer did not expect them. Where these are used, check that the basis for sending them is documented, that any consent was collected separately from the quote submission, and that opting out is straightforward.

Documents as well as pages

Privacy wording inside PDFs is easy to forget. Terms of business documents, claim forms and IPIDs often contain data protection statements that were written years before the current privacy notice. Observe IQ checks uploaded documents against the same rules as web pages, which makes these mismatches visible.

How Observe IQ helps

Observe IQ checks privacy information completeness, health data handling, recipient disclosure and cookie behaviour on the pages you scan, links each finding to the relevant provision or guidance, and suggests replacement wording for review.

Observe IQ is a compliance-support tool. Results should be reviewed by an appropriately qualified person. Observe IQ does not provide legal advice or guarantee regulatory compliance.