This is the GDPR update from our Pensions
Group,which summarises some practical aspects of where GDPR
processes for pension schemes are at one year on.
In the period since 25 May 2018, there have been a number of
minor breaches involving pension schemes which have generally been
closed without further action by the Data Protection
Commission. The Data Protection Commission's office has a
specifically appointed person in charge of the pensions industry
and is aware that pension schemes hold and control significant
amounts of personal data. It has become clear that carrying
out a dry run of the breach procedure and incident response plan is
a worthwhile exercise for trustees.
Many schemes have not yet been able to complete finalising GDPR
terms and conditions with all of their third party providers due to
the complexity of the interaction between investment platforms,
administrators, sponsoring employers and trustees. This means
that designing a practical data
