Here is a look at that part of the European Union's advice on the GDPR as relates directly to data auditing:

Accountability: The GDPR requires companies with more than 250 employees (or companies of any size, if the company handles sensitive data) to maintain an updated list of processing activities for inspection. A data impact assessment (for which an official template is available) is the best way to gauge a company's obligations in this respect.
Justification: Additionally, an insurance company must have legal justification for the data it records, retains, or processes, as outlined in Article 6 of the GDPR.
Disclosure: Article 12 requires robust transparency mechanisms to inform people that their data is being collected, and to define who may access the data and how the data is being secured.
Security: Stored data must adhere to the data protection principles of the GDPR Article 5 and follow the principles laid out there.
Encryption: The GDPR requires the use of encryption or 'pseudonymization' for stored data, and an insurance organization may need to provide evidence that this has been implemented.
Internal access: Besides the data itself, operational security will be included in any data audit, to establish the existence of a strong internal security policy.
Breach disclosure: Undisclosed breaches revealed by a data audit will invoke some of the strongest penalties, depending on the extent to which it can be established that the insurance company was aware of the breach.
Data officer: The GDPR requires that someone in the organization be accountable for compliance, and authorized to make necessary changes in policy. In certain circumstances, a Data Protection Officer must be employed and dedicated to these matters.
Sharing agreements: Where customer data is disclosed to third parties, agreements must be in place, and the EU provides a draft template for this purpose.
User control of existing data: Where customer data holds material on individuals, a data audit will need to demonstrate that the end-user can access and correct data held on them. Processes must also be in place to stop sharing or delete the data if requested.
Oversight of automated processes: This section of the GDPR crosses most into the coming European AI regulations, mandating that any automated decision processes that have a legal or 'similarly significant effect on an individual's rights must have human-led processes in place in the event of a challenge from end-users.

The state of data regulation in the U.K. and U.S.

In the U.K., the GDPR was copy-pasted into national law at the time of Brexit, with no obligation to retain the European standards in the future. Nonetheless, the Joint Information Systems Committee (JISC) offers the Data Audit Framework Development (DAFD) guideline document as a policy guide and preparatory checklist for companies researching data audit liabilities.

Special Reports /

A closer look at regulatory data audits in insurance

Related Stories

Recommended For You