New data protection complaints process for pension scheme members – what trustees need to know
From 19 June 2026, new legal requirements will apply to all pension scheme trustees in their role as data controllers. Under the Data (Use and Access) Act 2025 (“DUAA”), trustees, as data controllers, must have a process that allows members and other individuals to raise concerns about how their personal data is handled. The ICO has published guidance to help organisations prepare for these changes.
From 19 June 2026, new legal requirements will apply to all pension scheme trustees in their role as data controllers. Under the Data (Use and Access) Act 2025 (“DUAA”), trustees, as data controllers, must have a process that allows members and other individuals to raise concerns about how their personal data is handled. The ICO has published guidance to help organisations prepare for these changes.
What’s Changing?
The DUAA introduces a statutory right for individuals to complain directly to the data controller, generally recognised as being the trustee of the scheme, if they believe their data protection rights have been infringed. Eligible complainants include members, former members, beneficiaries, potential beneficiaries and ex‑spouses, reflecting the broad range of people whose data trustees may hold.
Trustees must provide a clear way for individuals to submit complaints, but the process does not need to be in a formal written policy. The ICO confirms that trustees can adapt existing processes, such as an IDRP, or use simple tools like an email address or online form. Importantly, trustees must accept complaints even if they are not submitted through the designated route.
What Trustees Must Do
Once a complaint is received, trustees must:
- Acknowledge it within 30 days, which can include automated email responses.
- Investigate and respond “without undue delay”, keeping the complainant updated throughout.
- Inform individuals of their right to complain when personal data is collected and when responding to subject access requests – this can be included in the scheme’s privacy notice.
These requirements sit alongside broader DUAA reforms, which give the ICO enhanced oversight and reinforce the importance of transparent data governance for pension schemes.
