Collect for the risk,not for the file.
Every extra field in a proposal form is a future request, a future breach and a future question.
In one line: Section 6 limits consent to personal data necessary for the specified purpose, and Section 8(7) requires erasure when the purpose is served. Together they require collecting and keeping only what is needed.
What you never collected can never leak.
The scene
The motor proposal form asked for marital status, education and employer. Underwriting used none of them. They had been added in 2009 for a cross-sell programme that closed in 2011.
Where the thinking breaks
The field audit
For each field: who uses it, for what, and since when. Fields with no user go first.
Monday morning
- 01Print your longest proposal form.
- 02Cross out fields no one can justify.
- 03Ship the shorter form.
Questions, answered plainly
Does DPDPA require data minimisation?
Section 6 limits consent to personal data necessary for the specified purpose, and Section 8(7) requires erasure when the purpose is served. Together they require collecting and keeping only what is needed.
Can insurers collect data for future cross-selling?
Collecting data for an unspecified future purpose is hard to reconcile with DPDPA's purpose-specific consent. Cross-selling should be a separate, notified purpose with its own consent.
Tell us where your data sits.We'll show you where the exposure is.
A partner replies within one working day, with a first view on your penalty exposure.
Speak to a partner