When a person is seeking a quotation for an insurance policy, it is part of the contractual process whereby the initial stages are known as “an invitation to treat”. This means that the customer provides relevant information to the insurance company for assessment; based on the information supplied, the insurance company then makes an offer of insurance with the relevant cost of same to the consumer, who in turn either accepts or rejects such offer.

If the consumer accepts the offer then formal contract relations are entered into by both the company and the consumer. If the consumer rejects the offer then the matter is at an end, as no legal relations have been created between the insurer and the potential customer. In accordance with the accountability principle of “storage limitation”, as set out under Article 5(1)(e) of the General Data Protection Regulation (GDPR), any personal data collected through the quotation process should be kept in a form which allows identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.  

Therefore, where the quotation process has concluded and there is no follow up by an individual to complete a contract, the data controller should ensure that the data collected is securely deleted within a limited ‘cooling off’ period (for example 21 days) in case the individual changes their decision to take up the contractual offer.