Introducing and running group insurance inevitably involves handling employee data: headcount and age profile for the quote request, a name list for contracting, sometimes a health declaration, and medical documents when a claim is filed. As an HR professional or a managing director, that is understandably a source of concern: who sees what, for how long, and on what basis? This article sets out what actually reaches the employer and what doesn't – without giving legal advice: the concrete approach should always be confirmed by the company's own data protection officer or lawyer.
- For the quote request and budget planning, names and health data are typically NOT needed – aggregated, numbered data is enough.
- The insured-person declarations and – where they apply – health declarations needed for contracting are typically handled directly by the insurer, not the employer.
- For a claim, the medical documents are submitted directly to the insurer by the eligible person – here too, the employer's role is more supportive than that of a data controller.
What reaches the employer – and what doesn't?
For the quote request and the needs assessment, an aggregated picture is typically enough: headcount, age profile, job roles, sites – without names or health data. The named list of insured persons only becomes necessary at contracting, and even then it typically stays limited to basic data. If the package also involves a health declaration – this typically arises above a defined sum insured (the so-called free cover limit), not necessarily only for management positions – it goes directly to the insurer: the employer typically does not get to see health data.
On what legal basis does the company handle this data?
This is already a genuine legal question, and its precise answer is settled in the company's own privacy notice and in the specific situation – processing necessary for the performance of a contract, legitimate interest or consent can all come into play, depending on what data and what purpose is involved. This question cannot and should not be settled in an article – this is exactly the point where the company's own lawyer or data protection officer (DPO) gives a reliable answer, alongside the steps of contracting and rollout.
Health data at claim time
Compared with the situation at entry, the picture is different for an actual claim: medical documents, findings, even a diagnosis can be involved. This qualifies as a special category of data, and it is submitted directly to the insurer by the eligible person – that is, the employee concerned or their dependant – following the list of required documents. Here too, the employer typically only sees that a claim is in progress – not the medical content itself, unless the colleague chooses to share it on their own initiative.
How long should data be kept?
The retention period is likewise not a single number that applies to everything – it depends on what data, for what purpose and under what legal basis. It naturally makes sense to keep the current insured-person list up to date for as long as the employment relationship lasts, and it is not advisable to keep former employees' data for longer than necessary. Exactly how long is answered by the company's own data-handling policy and the applicable legislation – again a point where, instead of a general rule of thumb, the specific guidance of a lawyer or data protection officer is what counts.
The role of the insurer and the broker
The insurer and the broker also play a part in handling the insured-person list and the documents linked to claims, typically each acting within their own scope of activity. Exactly how this works – as an independent controller or as a processor – is set out in the contractual documentation (privacy notice, agency agreement); this detail can differ by insurer and by structure, so it is worth asking about specifically at the start.
Good practice for the joiner–leaver routine
For managing joiners and leavers, the best principle is data minimisation: only the data actually needed for enrolment and eligibility should move around, and at departure no data that no longer serves a purpose should be left sitting in the system unnecessarily. A regularly updated, numbered list is far safer than a name-filled spreadsheet that hasn't changed in years.
What is worth telling the team?
Transparency alone builds trust: a sentence or two in the onboarding announcement or the internal FAQ, explaining that the employer does not see into health data, defuses a lot of reservations. A short, honest explanation is typically worth more than silence – especially for a benefit whose whole point is trust.
A question about your own company's data-handling practice? Book a free 20-minute consultation →
