If an employee provides family members' details for insurance, what steps ensure compliance?

Do we need consent from them or not? Is it legitimate purpose? Are there any specific guidelines which can help verify wether a purpose is legitimate or not.