Pensions Essentials - February 2026

The Data (Use and Access) Act provides that data controllers must facilitate the making of complaints in relation to data protection issues. Trustees are data controllers for these purposes and administrators may also be. The ICO has also issued guidance about these new requirements, which will apply from 19 June 2026.

Key points to note include:

• Complaints will need to be acknowledged within 30 days of receipt (which includes bank holidays and weekends). There is no prescribed form of acknowledgement or particular information that needs to be given, but a record should be kept.
• In-scope complaints could include how trustees have responded to a subject access request, the security measures used to store personal information (eg. where there has been a data breach, regardless of whether it’s reportable), or how personal information has been collected. If it is not clear whether a complaint relates to data protection, trustees or administrators should ask.
• Trustees must provide a way for individuals to complain about data protection issues. This may be via a form, but if someone complains in another way, this will still need to be dealt with. This means that everyone involved with a scheme should be trained to recognise data protection complaints.
• Appropriate steps must be taken to respond to a complaint and the complainant must be informed of the outcome, in both cases “without undue delay”. The guidance says that this means without “an unjustifiable or excessive delay” and that the obligation to investigate begins on receipt of the complaint, not after the end of the 30-day acknowledgement period.
• If the trustees choose to use the IDRP to deal with data protection complaints, they “must ensure that this doesn’t cause an unjustifiable or excessive delay". If they can complete the data protection investigation in a shorter amount of time than the IDRP requires, they must do that. In addition, if a complaint relates to a number of issues, including data protection, and a decision can be reached on data protection sooner than on the other issues, that must be done.
• Data controllers must tell people about their right to complain and this information must be given both at the point that personal information is collected (eg. in the privacy notice) and when responding to a subject access request. Trustees should therefore consider reviewing their privacy notices and subject access request processes.

PASA has published guidance aimed at supporting trustees, administrators and advisers to navigate the practical issues they might encounter in relation to buy-in and superfund transactions. It identifies a number of key themes:

• Align administration early: early engagement allows administrators to understand provider requirements, embed changes into systems and workflows, and prepare staff well in advance of transfer.
• Compliance and processes: benefit calculation and payment should be aligned with provider processes.    
• Data integrity and reporting: data quality is key and is an ongoing requirement post-completion.
• Transparent member communications: members should be kept informed throughout the transition and changes should be explained clearly, with prepared FAQs and scripts for common queries.
• Adjustments for deferred members: adapt systems, processes and expectations to align with insurer requirements, while continuing to deliver timely, accurate information to members.
• Risk management: these types of transaction introduce a range of operational, data, payroll and communication risks. Effective risk mitigation relies on early identification, clear ownership and proactive planning.
• Resourcing and budgeting: agree scope, fees and contingency budgets early; leverage provider expertise and maintain regular progress update calls.

In addition, TPR is continuing to update its superfund guidance in advance of the new superfund regime under the Pension Schemes Bill. Schemes looking at a superfund transfer should ensure that they are looking at the most recent version. 

Appeal from Ombudsman determination: In a recent case the court looked, amongst other things, at when an Ombudsman determination can be appealed. The case was brought by individuals who were trustees or managers of three schemes that the Ombudsman had determined were scams and whom he had ordered to pay substantial sums into the schemes and to various scheme members. 

One basis of appeal related to whether a member had brought a claim in time, which in turn related to the question of when they could reasonably have known of various issues. The judge considered that this actually related to a question of fact, and therefore an appeal could only succeed if it could be shown that there was no basis in the evidence for the Ombudsman's conclusion (or that the conclusion was perverse), or that the Ombudsman took into account irrelevant considerations, or ignored relevant considerations. There was no evidence that this was the case. 

Another basis related to findings of dishonesty which prevented reliance on an exoneration clause. It was argued that when assessing their conduct, the Ombudsman held the trustees to too high a standard, as they had limited experience in the pensions industry.  The judge said that the appropriate standard for judging dishonest conduct was the “standards of ordinary decent people”. In asserting that the Ombudsman held them to "too high a standard", the individuals were seeking to displace his conclusions as to how much allowance ordinary decent people would have made for their inexperience in the pensions industry.  This was therefore also a challenge to a conclusion of fact and the court found no reasons to doubt the Ombudsman’s conclusions.

The case is a useful reminder of the limited circumstances in which the courts will reconsider findings of fact made by the Ombudsman. 

Deferred member entitlement: R was a member of the Midland Bank Scheme between 1972 and 1990. She received a transfer quote in 1991 and the trustee’s records showed that her benefits were transferred to a personal pension scheme in 1992. In 2016, R sought payment of her benefits from the Scheme and was told they had been transferred out. The subsequent owners of the personal pension scheme could find no record of R’s benefits. HMRC’s contracting-out data showed R had three periods of membership in the Scheme, two of which had been transferred out. R complained that she had no memory of requesting or consenting to any transfer and that the Scheme should provide a deferred pension. 

The Deputy Ombudsman (DPO) determined that it was unlikely that R “would have initiated a substantial financial transaction such as a transfer and have no memory of it” or that she would not have followed up when she received no documentation in relation to the transfer. In addition, the personal pension scheme was required to keep detailed records in relation to transfers indefinitely following the review into personal pensions mis-selling and the fact its successor has no records in relation to R also indicated that a transfer did not take place. Finally, had the transfer actually been made, it would have been outside the statutory window for doing so. 

The DPO also criticised the trustee for acting as if it were for R to “disprove that a transfer took place, rather than for the Trustee to prove that it had made a transfer payment and had been discharged of all liability”.  She concluded that R should be entitled to a pension from the Scheme.

This is an interesting determination, as the only entity that seemed to have any evidence was the Scheme and that was held to be unreliable. It shows the importance of considering historical data against the entirety of the factual background. It also illustrates a desire to ensure that a member receives a pension from somewhere.