The upcoming EU's General Data Protection Regulation (GDPR) applies to all companies with personal records, but there are certain aspects insurers are finding particularly difficult. Cintia Cheong reports