Data is the most valuable resource of an information system. While most information is made up of personal data, every effort is made to protect it, reduce threats and risks, and ensure that the required information is available at the required time to authorized persons. This paper presents a model for the protection and control of personal information of clients (business partners) and employees in an insurance company. In doing so, the existing information system of the insurance company, which covers business processes using certain personal data, was analyzed. By using a modern (relational) organization of data, it is possible to establish, in addition to existing ones, new security measures that will ensure continuous control over the use and distribution of personal data. By applying the General Data Protection Regulation, which came into force on May 25, 2018, further protected personal data and left the control of data management to the owner of that information. The regulation affected all organizations of EU Member States as well as those organizations that do business with European companies.