What can an insurance broker do with my personal data?
In short
What can an insurance broker do with my personal data? Only what he needs to advise you, get quotes and look after your policies. Health data may only be used with your explicit consent (Art. 9 GDPR). On request you get free access to your data within one month (Art. 12 and 15 GDPR) and can ask for erasure unless a legal duty to keep records applies.
Your data protection rights cost you nothing. Periods and exceptions are set out in the GDPR.
Example
Typical range
Access to stored data
0 euros, answer within 1 month
Extension for complex requests
by at most 2 further months, with reasons
First copy of your data
0 euros, further copies for a reasonable fee
Retention of business letters by the broker
6 years under § 257 HGB
Statutory periods, as of October 2026.
Whether and how long a broker must keep other records depends on his legal form and tax law.
Worked example
Access request after switching brokers
Ms K. has switched brokers and wants to know what the old broker still stores about her.
Request sent by e-mail
3 March
Latest reply without extension
3 April
Cost of the first copy
0 euros
Health data after withdrawal of consent
no longer usable for new quotes
Ms K. learns which data is still stored and why. Anything not covered by a retention duty must be deleted.
What a broker may use your personal data for
An insurance broker needs your data to get quotes: name, address, date of birth, the car for motor cover, the floor space for contents insurance. That is allowed as far as it is needed for the broker agreement and the insurance you asked for (Art. 6 (1) (b) GDPR, in German DSGVO).
For this he passes the data to the insurers he approaches on your behalf. He may not hand your data to third parties without reason or use it for other companies' advertising. He has to tell you which recipients are possible when he collects the data.
Health data needs your explicit consent
For health, disability, long-term care or life insurance, insurers ask about your health. These are special categories of personal data. A broker may only process them if you have explicitly consented (Art. 9 (1) and (2) GDPR).
Read the consent form carefully: it should say which insurers receive your health data and why. You can withdraw consent at any time (Art. 7 (3) GDPR). Processing up to then stays lawful, and without consent the broker can no longer obtain health related quotes.
Your rights towards the broker
You can ask at any time which data the broker holds about you. The answer must come within one month; for complex cases the period can be extended by two months (Art. 12 (3) GDPR). The first copy is free (Art. 15 (3) GDPR).
You can also get your data in a common format, for example when switching brokers (Art. 20 GDPR). If there is a dispute, you can complain to the data protection authority of your federal state (Land).
Your right
What it means
Access (Art. 15)
which data, where from, passed to whom, kept how long
Rectification (Art. 16)
have wrong details corrected
Erasure (Art. 17)
when the data is no longer needed and no duty to keep it applies
Portability (Art. 20)
receive data in a common format
Objection to marketing (Art. 21)
no more advertising, effective at once
When a broker does not have to delete your data
Brokers must delete data without undue delay once the purpose has gone. The exception: when the law requires the data to be kept (Art. 17 (3) (b) GDPR). Merchants, for instance, must keep business letters sent and received for six years (§ 257 HGB, German Commercial Code).
For you this means: after you stop working together, files on policies the broker arranged may stay archived for some years. They may no longer be used for advertising or new quotes. At NAMMERT, Norman Nammert acts as an insurance broker; the privacy notice explains which data is processed and why.
Step by step
Read the broker's privacy notice before the first meeting.
Give consent for health data only for the insurers to be approached.
Say no to advertising if you do not want it.
Ask for access in writing and note the date.
After the end of the relationship, ask for erasure as far as no duty prevents it.
Checklist
Privacy notice received
Health data consent understood
Recipients of the data named
Marketing preference set
Date of any access request noted
Common mistakes
Signing a health data consent without knowing the recipients
Assuming everything must be deleted the moment you switch brokers
Giving health details over the phone instead of checking them in writing
Questions and answers
Frequently asked
May my broker pass my data to insurers?
Yes, to the insurers he approaches for you or whose policies he looks after.
Health data only with your explicit consent.
May the broker call me to offer something new?
Advertising has its own rules.
You can object at any time, and then it must stop.
What does an access request cost?
Nothing.
Only further copies may cost a reasonable fee.
What happens to my data after switching brokers?
The old broker may only keep it where the law requires and may not use it for new offers.
Where can I complain?
To the data protection authority of your federal state.
A written question to the broker first is often quicker.
