A customer asks SUURA to request their own data or a historic record from an insurer. This is either a subject access request under UK GDPR, which the customer authorises SUURA to send for them, or a motor no claims discount letter. SUURA checks the customer's identity, obtains a signed Letter of Authority, and sends you the request. You decide what to release and reply through the portal.
| Data | Purpose | Shared with you |
|---|---|---|
| Name, date of birth, address, contact details | Identify the customer and match their record | Yes, the items needed to find the record |
| Policy number, vehicle registration, period | Locate the record | Yes, as supplied by the customer |
| Photo ID and proof of address | Identity check | No. You receive confirmation that checks passed, not the images, unless agreed |
| Signed Letter of Authority | Evidence the customer authorised the request | Yes |
| Your reply and the record | Return the record to the customer | Originates from you |
The pilot is limited to motor no claims discount letters. Customers may also send subject access requests under their own legal rights, outside any pilot. SUURA does not ask for payment card details to make a request.
| Area | Position | Status |
|---|---|---|
| Identity assurance | Photo ID and address verified before a request is sent | Designed. Provider to be confirmed |
| Authority | Signed Letter of Authority with an expiry date attached to every request | Designed |
| Access control | Named accounts for insurer staff. Customers only see their own requests. SUURA staff access is limited and logged | Designed for the portal |
| Audit trail | Time-stamped record of each action on a request | Designed |
| Encryption in transit | Secure connections (HTTPS) to the service | In place |
| Encryption at rest | Sensitive documents encrypted with separate keys before live data is used | Planned |
| Sign-in | Email sign-in links for customers. Insurer sign-in method (including multi-factor) to be agreed | To be agreed |
| Marketing separation | Early-access marketing list is separate from request data, with a working unsubscribe | In place |
| AI assistant | The public assistant gives general information only and is told not to take personal details | In place |
SUURA uses third-party suppliers for hosting, email delivery and its general-information assistant. The named list, the country each uses for processing and the transfer safeguards will be provided in the data processing agreement. Hosting region: to be confirmed.
Documents are kept only as long as needed to complete the request and pass the record to the customer. The period will be agreed with you. On request, and at the end of a pilot, pilot data is deleted and we confirm in writing.
A customer can withdraw their authority at any time. A withdrawn request is removed from your queue and the withdrawal is logged. Customer data subject requests that reach SUURA about your records are passed to you.
If we suspect a personal data breach affecting your data we will tell you without undue delay. A notification timeframe will be written into the agreement so you can meet your own duty to report to the ICO within 72 hours where required.