From 19 June 2026, all pension scheme trustees will be required, as data controllers, to have a process in place for the handling of data protection related complaints.
Trustees will need to amend their existing complaints handling processes to ensure that they comply with the new statutory requirements.
We take a look below at the key requirements and the practical steps trustees should be taking now.
Background
The Data (Use and Access) Act 2025 requires all data controllers (including trustees) to have a process in place by 19 June 2026 for the handling of data protection related complaints. The complaints process must comply with certain requirements (which are summarised below).
The ICO has issued accompanying guidance to assist data controllers in complying with the new obligations: How to deal with data protection complaints.
