Jade Kowalski
Jade is a specialist data protection lawyer who advises clients across a number of different sectors. She advises on the full range of data protection issues such as complex data sharing arrangements, the use of cookies, marketing and the use of artificial intelligence. She is known for her practical, pragmatic approach to managing risk and ability to digest complex data protection issues into accessible, commercial advice.
Her full service practice includes:
- Undertaking fully outsourced data protection compliance reviews;
- Handling complex data subject requests;
- Responding to and defending ICO investigations;
- Designing appropriate data protection frameworks and accompanying policies and procedures; and
- Providing strategic advice on data protection risk appetite and tolerance.
Jade has particular experience and expertise in advising clients in the insurance industry. She is a trusted adviser to clients across the sector including (re)insurers, brokers and industry bodies. Having spent a number of years on client secondment, Jade has a thorough understanding of the sector and is able to apply her legal expertise to its complex arrangements and data flows with ease. Her practical approach to problem solving and advising is highly regarded by clients.
Jade is a member of a number of insurance market data protection committees and, in the lead up to the implementation of the GDPR, was extensively involved in considering compliance at an industry level. In particular, Jade was jointly instructed by the Association of British Insurers (ABI) and the Lloyd’s Market Association (LMA) to work with Government on a new legal ground processing of special category data and information relating to criminal convictions in the insurance sector. She was instrumental in its inclusion in the Data Protection Act 2018.
Examples of insurance sector specific experience include:
- Advising on data protection issues arising out of the use of aggregators in the distribution chain;
- Leading a complex data protection impact assessment for a retail household insurer regarding the use of personal data for pricing; and
- Advising on industry data sharing initiatives to tackle insurance fraud.
1 Contributions by Jade Kowalski
PRACTICE NOTES
Insurers’ data protection compliance under UK GDPR, DPA 2018 and DUAA 2025 reforms: principles, lawful bases, special category/criminal data, research, automated decision-making, data subject rights, notices and exemptions
IMPORTANT NOTE:
The provisions of the Data (Use and Access) Act 2025 (DUAA 2025) are being introduced in stages. You should therefore check whether the specific provision in question has been commenced by the relevant commencement regulation.
This Practice Note outlines the core data protection considerations for insurers when handling personal data under the UK General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR), the Data Protection Act 2018 (DPA 2018) and DUAA 2025. It highlights the data protection principles, lawful bases for processing, data subject rights and applicable exemptions. For a fuller overview of the UK GDPR, see Practice Note: The UK General Data Protection Regulation (UK GDPR).
The insurance market is notably rich in data. Insurers depend on collecting and processing personal data for key operations such as pricing premiums, detecting fraud and administering claims. Nevertheless, the sector’s complexity and, in particular, its distribution chains can create practical difficulties in complying with data protection duties.
Data protection principles
All controllers must comply with the data protection principles. For a complete overview, see Practice Note: Data protection principles. The following principles may raise specific challenges for insurers...
Insurance & Reinsurance
If you expected to see yourself on this page, click here.
