Pensions schemes need to get ready for the introduction of the General Data Protection Regulation (GDPR) in less than a year.

The regulations come into force in May 2018 and will transform how businesses store and manage personal data.

Pension schemes will need to make sure data processes protect the rights of individuals, by establishing an organised data protection programme.

This obligation extends to any third-party administrators or advisors working with the scheme.
Failure to comply could see schemes facing penalties of up to €20m, or four per cent of annual turnover, whichever is higher.

Audit, tax, and consulting firm RSM is urging schemes to complete their preparation as soon as possible to avoid damaging their reputation or taking a financial hit – both of which could be the result of non-compliance.

Steve Snaith, technology risk assurance partner at RSM, said the new legal framework is the biggest change to data privacy legislation in over two decades.

"It will pose particular challenges to pension schemes as they hold vast amounts of sensitive member data that could be valuable to cybercriminals," he said.

"It's vital that clear processes and safeguards are put in place to protect schemes and their members."

Snaith added that although GDPR will be a welcome attempt to curb fears around how companies use and manage personal information, the new framework will have a drastic impact on the future of stored data and increased company accountability.

"Pension schemes must make sure they are ready for what lies ahead and not get caught out as the financial and reputational risk could be significant," he said.

RSM is the UK's seventh largest firm of audit, tax, and consulting services and operates from 35 locations across the country.

First published 01.06.2017

Lindsay.sharman@wilmingtonplc.com