GDPR and US State Privacy Laws: Compliance Requirements for Pet Insurance MGAs Collecting Customer Data

Insurance

GDPR and US State Privacy Laws: Compliance Requirements for Pet Insurance MGAs Collecting Customer Data

|Posted by Hitul Mistry / 14 Mar 26

Pet insurance MGAs collect sensitive personal information from pet owners and veterinary providers. Understanding your data privacy obligations prevents regulatory violations and builds customer trust.

Talk to Our Specialists

What Data Does a Pet Insurance MGA Collect?

A pet insurance MGA collects three main categories of data: pet owner personal information (name, address, email, phone, date of birth, payment details), pet information (species, breed, age, health history, vaccination records), and claims data (veterinary invoices, medical records, treatment descriptions, provider information, and claim photographs). All of this data is subject to various privacy laws.

1. Pet Owner Personal Information

Full name, address, email, phone number
Date of birth
Payment information (credit card, bank account)
Social security number (in some states for billing)
Communication preferences

2. Pet Information

Species, breed, age, sex
Microchip or registration numbers
Veterinary medical history
Pre-existing conditions
Vaccination records

3. Claims Data

Veterinary invoices and medical records
Treatment descriptions and diagnoses
Prescription information
Provider information
Claim photographs

What Privacy Laws Apply to Pet Insurance MGAs?

The key privacy laws applicable to pet insurance MGAs include CCPA/CPRA (California), the NAIC Insurance Data Security Model Law (adopted in many states), state-specific privacy laws in Virginia, Colorado, Connecticut, and Utah, GDPR if serving UK/EU customers, and PCI DSS for payment card data. While some CCPA provisions have narrow insurance exemptions, MGAs should not assume full exemption.

1. CCPA/CPRA (California)

The California Consumer Privacy Act (as amended by CPRA) applies if you:

Do business in California
Meet revenue or data processing thresholds
Collect personal information from California residents

Key Requirements:

Privacy policy disclosures
Right to know what data is collected
Right to delete personal information
Right to opt out of data sales
Right to correct inaccurate data
Data minimization principles

Insurance Exemption Note: Some CCPA provisions have exemptions for data governed by other laws (like insurance information regulations). However, the exemptions are narrow and evolving don't assume full exemption.

2. NAIC Insurance Data Security Model Law

The NAIC model law (adopted in many states) requires:

Written information security program
Risk assessment procedures
Access controls and authentication
Encryption of sensitive data
Incident response plan
Vendor management program
Annual certification to state DOI

3. Other State Privacy Laws

Multiple states have enacted comprehensive privacy laws:

Virginia — Consumer Data Protection Act
Colorado — Privacy Act
Connecticut — Data Privacy Act
Utah — Consumer Privacy Act
And growing — Additional states adding privacy laws annually

If your MGA serves customers in the UK or EU:

Lawful basis for processing required
Data Protection Impact Assessments for high-risk processing
Right to be forgotten
Data portability rights
72-hour breach notification
Data Protection Officer appointment may be required
Note: Pet health data is not "special category data" under GDPR Article 9 (that's human health data), but pet owner data is personal data

5. PCI DSS

If you process payment card data:

Comply with PCI Data Security Standards
Use PCI-compliant payment processors
Never store full card numbers in your systems
Regular security assessments

How Do You Build a Privacy Program for a Pet Insurance MGA?

Building a privacy program involves five steps: data mapping to document all data collected, stored, accessed, and retained; creating a comprehensive privacy policy; implementing an information security program with encryption, access controls, and incident response; establishing vendor management with data processing agreements; and building consumer rights procedures to handle access, deletion, opt-out, and correction requests within required timelines.

1. Data Mapping

Document what data you collect, where it's stored, who accesses it, and how long you retain it:

Data Category	Collection Point	Storage Location	Retention Period
Owner personal info	Application	PAS database	Policy life + 7 years
Payment data	Enrollment/renewal	Payment processor	Per PCI DSS
Pet health data	Claims submission	Claims system	Policy life + 7 years
Veterinary records	Claims support	Document management	Policy life + 7 years

2. Privacy Policy

Create a comprehensive privacy policy covering:

What data you collect and why
How you use the data
Who you share data with (carrier, reinsurer, TPA)
Consumer rights by state
Data security measures
Retention and deletion practices
Contact information for privacy requests

3. Information Security Program

Implement security measures:

Data encryption (at rest and in transit)
Access controls (role-based access)
Multi-factor authentication
Regular security testing
Employee security training
Incident response plan

4. Vendor Management

Your third-party vendors must also comply:

Data processing agreements with all vendors
Security assessment of vendor practices
Contractual requirements for data protection
Incident notification obligations

5. Consumer Rights Procedures

Build processes to handle:

Data access requests
Data deletion requests
Opt-out requests
Data correction requests
Response within required timelines (typically 30–45 days)

What Are the Data Breach Response Requirements?

Data breach response requirements include notifying the state DOI within 72 hours (in some states), affected consumers within 30–60 days, the state attorney general as required, and credit bureaus within 60 days if 500+ consumers are affected. MGAs must maintain a written incident response plan covering detection, containment, notification, investigation, remediation, and documentation.

1. Notification Requirements

Authority	Timeline	Threshold
State DOI	72 hours (some states)	Any breach of insurance data
Affected consumers	30–60 days	Personal information exposed
State AG	Varies	Varies by state
Credit bureaus	60 days	500+ consumers (in some states)

2. Incident Response Plan

Maintain a written plan covering:

Detection and assessment procedures
Containment steps
Notification procedures and timelines
Investigation and root cause analysis
Remediation and prevention measures
Documentation and reporting

What Are the Pet Insurance-Specific Privacy Considerations?

Pet insurance-specific privacy considerations include the fact that HIPAA does not apply to pet health records (though pet health data may be indirectly linked to human health through emotional support animals), veterinary records shared during claims become MGA business records subject to state insurance privacy regulations, and data sharing agreements must be established with veterinary clinics defining permitted uses and security requirements.

1. Pet Health Data vs Human Health Data

HIPAA does not apply to pet health records
However, pet health data may be indirectly linked to human health (emotional support animals, etc.)
Veterinary records shared during claims are considered MGA business records
State insurance privacy regulations apply to all policyholder data

2. Veterinary Provider Data

When receiving data from veterinary clinics:

Establish data sharing agreements
Define permitted uses of veterinary data
Address data security requirements
Comply with any veterinary practice privacy policies

For technology security requirements, see our cybersecurity compliance guide.

Talk to Our Specialists

Frequently Asked Questions

Does HIPAA apply to pet insurance data?

No. HIPAA only covers human health data. Pet owner personal information is subject to state privacy laws.

What data privacy laws apply to pet insurance MGAs?

CCPA/CPRA, state privacy laws, NAIC Insurance Data Security Model Law, PCI DSS, and GDPR if serving EU/UK customers.

What data does a pet insurance MGA collect?

Pet owner personal information, pet health data, payment data, and claims data including veterinary records.

What should be in an MGA's privacy policy?

What you collect, how you use it, who you share it with, retention period, consumer rights, security measures, and contact information.

How should an MGA handle a data breach?

Follow your incident response plan: detect and contain the breach, notify the state DOI within 72 hours, notify affected consumers within 30–60 days, report to the state AG, and conduct root cause analysis.

What is the NAIC Insurance Data Security Model Law?

A model law requiring a written information security program, risk assessments, access controls, encryption, incident response plans, vendor management, and annual DOI certification.

MGAs need lawful processing basis, Data Protection Impact Assessments, breach notification within 72 hours, and may need a Data Protection Officer. Pet owner data is personal data under GDPR, though pet health data is not special category data.

What vendor management steps are required for data privacy compliance?

Execute data processing agreements, conduct security assessments, include contractual data protection requirements, and require incident notification obligations from all vendors handling personal data.

External Sources

Internal Links

Explore Services → https://insurnest.com/services/
Explore Solutions → https://insurnest.com/solutions/