In this update, I’ll explain what to do if you, as the data controller, receive customer requests or enquiries under the new legislation and how LifeQuote will work with you to complete them together with some reminders as the GDPR deadline approaches.

As you know, our privacy notice has been updated and is in place. This makes it clear how we are handling your customers’ data and is a good starting point for any enquiries. Customer rights are enhanced under GDPR and include the following:

Access – Customers can access all data held about them which will need to be supplied within 30 days from the request, free of charge – we will summarise all data pertaining to the customer and liaise with you to provide this to them as required.

Rectification – Customers can have inaccurate personal data rectified, or completed if it is incomplete – much like the current process if a customer informs you of a change to their personal data. You will simply need to inform us so we can update our records and pass this information to the relevant insurer.

Erasure – A right for customers to have their personal data erased, which is commonly known as the ‘right to be forgotten’. If an application has been made we will have a legal requirement to keep the data under our agreed retention period for the establishment, exercise or defence of potential legal claims. We have some wording to help manage such requests.

Restriction – Customers have the right to restrict the processing of their personal data in certain circumstances. This means that an individual can limit the way that an organisation uses their data. This is an alternative to requesting the erasure of their data – if a customer requests their data to be restricted we will immediately cease the processing of this data and inform the insurer of the customer’s request. Restriction will involve still holding the data on our systems but with notes to confirm that the processing has been restricted.

Objection – Individuals have the right to object to the processing of their data. Our legal basis for processing the data is to fulfill a contract (on your behalf) but again we will immediately cease the processing of this data and inform the insurer of the customer’s request. This will involve us holding the data on our systems but with notes to say the customer has withdrawn consent.

Data Portability – The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services. We will liaise with advisers and insurers in such circumstances.