Insurance Claims: What to Mask in a Claim File Before Sharing It
A claim file mixes health data, bank details and witness accounts. See who legitimately needs what, with a recipient-by-recipient masking guide.
A claim file mixes many kinds of data. It can include the policyholder's contact details, photos of the damage, a repair quote, sometimes a medical report, and a bank account for the payout. Not every person you send it to needs all of that. Mask what a recipient does not need for their specific job, every time you forward the file.
What does a typical claim file contain?
A file built around a claim usually starts the same way, whatever the type of loss. It carries the policy number and the story of what happened. It also carries the practical details an insurer needs to check the story and pay a fair amount.
- Policy number and dates of cover
- Description of the loss, in the claimant's own words
- Photos, receipts and repair or replacement quotes
- A bank account for the payout
- A police or fire report, when one exists
- For an injury claim, a doctor's letter or a clinic invoice
Why do injury details count as special category data?
Health data gets its own rule. Article 9 of the GDPR bans processing data concerning health, along with a short list of other sensitive categories, unless an exception applies. The UK's ICO lists legal claims among those exceptions: processing is allowed when it is necessary to establish, exercise or defend a legal claim. That covers most injury files, but it does not turn the rest of the health record into fair game.
The exception covers the claim, not the whole medical history. France's data protection authority, the CNIL, states that processing health data is, in principle, forbidden, and only permitted for a specific, necessary purpose. A two-line note on the sprained wrist a claim is actually about answers most questions. The rest of a clinic's file rarely needs to travel with it.
Are witnesses and other people in the file protected too?
Yes. A claim file is rarely about one person. Germany's insurance association, GDV, names this group directly in its data protection code of conduct. People outside the policy itself, such as an injured third party or a witness, are still data subjects with their own rights. Imagine Jane Example, rear-ended at a red light. Her neighbor, who saw the crash, gave a statement. That neighbor's phone number is personal data too, and it does not belong on every copy of the file.
Who needs what? A recipient-by-recipient guide
The same file often travels to a garage, an independent expert, a lawyer and a reinsurer. Sometimes it even reaches a training file for new claims handlers. Each one has a different job, and a different need for the details inside.
| Recipient | Typically needs (keep) | Mask before sending |
|---|---|---|
| Repairer or garage | Vehicle details, the damage description, a pickup address, a phone number. | Bank details, medical information, the policy's price, any unrelated earlier claim. |
| Independent expert | The facts of the incident, damage photos, the policy terms that apply, and a doctor's note limited to this injury. | The rest of the medical history, other family members' data, unrelated claims on the same policy. |
| Lawyer handling a dispute | Most of the file: Article 9's legal-claims exception covers this stage. | Other claimants' files, and any third person's data this specific case does not need. |
| Reinsurer | The claim amount, the reserve, and a case category. | The claimant's name and health details, unless the treaty needs a named file for one large claim. |
| Training or a case study | The type of incident and the lesson it teaches new handlers. | Every real name, address, phone number, IBAN, plate and date. |
Who counts as a controller changes the paperwork, not the habit. France's CNIL treats an expert as a processor when their task is tightly scripted by the insurer. It treats the expert as a controller when they decide the purpose and method themselves. A reinsurer is usually its own, separate controller under its own contract. Whatever the label, the same rule holds: send what the task needs, not the whole file.
How do you mask a claim file before you send it?
- 1Name the recipient and their exact task before you open the file.
- 2Remove the bank details and the payout amount unless that recipient needs them.
- 3Cut the medical narrative down to the line the claim is actually about.
- 4Keep a witness's or a third party's contact details out of copies that do not need them.
- 5Send a flattened copy, not the original file, so nothing sits hidden under a mask.
- 6Note what you sent, and to whom, for your own file.
Software can speed up the mechanical part of this. ONYRI Sanitize works inside the browser, so the claim file is never uploaded. It finds names, addresses, phone numbers, IBANs and ID numbers on PDFs and scans. Its limit: it detects ICD-10 codes but not medical terms in plain words. Injury details written out still need a custom rule or the Also mask list, checked in the preview.
None of this replaces judgment. A rare condition, an unusual job, or a small town can still point back to someone even after you mask the obvious fields. Read the file the way each recipient will, and send them only the slice their task actually needs.
Frequently asked questions
- Does everyone who receives the file need the same information?
- No. A garage needs the vehicle and the damage. A lawyer building a legal claim can rely on Article 9's legal-claims exception for more. Match what you send to the specific task in front of that recipient, not to one file you reuse for everyone.
- Is a witness's phone number personal data I have to protect?
- Yes. A witness did not choose to be part of a claim, but their name, address and phone number are still personal data under the GDPR. Share them only with a recipient whose task actually requires contacting that witness, such as a lawyer preparing a case.
- Who decides whether an expert is a data controller or a processor?
- It depends on the facts, not on what the contract calls them. France's CNIL treats an expert as a processor when the insurer tightly scripts their task. It treats them as a controller when the expert decides the purpose and method. Either way, send only what their assessment needs.
- Does masking a claim file make it fully GDPR compliant?
- No single step does that. Masking reduces exposure and limits who sees what, which is real progress. It does not replace a lawful basis, a retention period, or a human check of the preview before the file goes out.
Sources & references
- What are the rules on special category data? (legal claims exception) — Information Commissioner's Office (ICO)
- What is special category data? — Information Commissioner's Office (ICO)
- Article 9 GDPR — Processing of special categories of personal data — Regulation (EU) 2016/679, via gdpr-info.eu
- Code of conduct for the handling of personal data by the German insurance industry — GDV (Gesamtverband der Deutschen Versicherungswirtschaft)
- The principle of minimisation and the processing of health data in the insurance sector — CNIL (French data protection authority)
- The qualification of insurance-sector actors under the GDPR — CNIL (French data protection authority)
Mask a document without uploading it
ONYRI Sanitize finds names, identifiers, bank details and secrets in a PDF, a Word file or a scan, and masks them in your browser. You check the preview, then download a flattened copy.