Pension Services (Lancashire County Pension Fund)
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council as Administering Authority of Lancashire County Pension Fund (the Fund) would like to provide you with the following details.
Contact details of the Fund:
Note that for queries intended for the Fund more generally (not specifically relating to data protection concerns), please do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact: pensionsgovernance@lancashire.gov.uk
Why we are providing this notice to you
The Fund may hold certain information about you and from which you can be identified ("personal data") which is used to administer the Fund and assist Local Pensions Partnership Administration (LPPA) in administering the Fund on your behalf. In line with data protection legislation, we are required to give you specified information about the personal data we may hold about you, how we use it, your rights in relation to it and the safeguards that are in place to protect it. This notice is designed to give you that information.
Reasons for processing your personal data
The Fund administers and manages the Local Government Pension Scheme (LGPS) for eligible members, retirees, and beneficiaries of the Fund. LPPA is a third-party service provider which has been contracted to undertake the administration of pension benefits on behalf of the Fund.
The Fund holds personal data about you, in its capacity as a controller, for the proper handling of all matters relating to the Fund, including its administration and management. This includes the need to process your data to contact you, to assist in the calculation of benefits, secure and pay your benefits, for statistical and financial modelling and for reference purposes (for example, when we assess how much money is needed to provide members' and beneficiaries' benefits and how that money should be invested), and to manage liabilities and administer the Fund generally.
The Fund processes minimal personal data while fulfilling its duty in managing the Fund. This includes:
- Processing member queries submitted directly to the Fund.
- Responding to Internal Dispute Resolution Procedures (IDRP) complaints.
- Admittance of new employers to the Fund.
- Ensuring compliance with statutory obligations under pension legislation.
- Any other processing of personal data required in the Fund oversight role for services provided.
Any personal data held by the Fund is shared only where necessary with authorised bodies such as LPPA, the Additional Voluntary Contributions (AVC) provider, the actuary, and government departments.
LPPA processes personal data as part of its role in providing the administration service to the Fund, this includes but is not limited to:
- Maintaining accurate records of scheme members.
- Calculating and processing pension benefits and contributions.
- Managing communications regarding pension entitlements.
- Ensuring compliance with statutory obligations under pension legislation.
Click here to see LPPA's privacy notice for more information.
All data is handled in accordance with data protection legislation listed below, ensuring confidentiality, integrity, and appropriate security measures.
The relevant data protection legislation includes:
- the UK Data Protection Act 2018.
- the UK GDPR (as defined in the section 3(10) Data Protection Act 2018.
- the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003) (as amended and incorporated into the laws of England & Wales, Scotland and Northern Ireland).
- the General Data Protection Regulation 2016/679.
- the Data (Use and Access) Act 2025; and
all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications).
Use of artificial intelligence (AI) technologies
Al technology is primarily utilised within the Fund team using Microsoft Copilot Web and Microsoft Copilot 365. Please consult Lancashire County Council's (LCC) Artificial Intelligence privacy notice for more details of how we use these specific platforms.
The Fund does not use AI to make automated decisions or process personal information. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
Legal basis for processing personal data
The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:
(c) Legal Obligation: the processing is necessary for us to comply with our legal obligations in connection with the administration and management of the Fund and the LGPS.
This may apply in circumstances including, but not limited to, where the Council is required to report or disclose data to regulatory bodies, government departments, or comply with pension legislation.
(e) Public Task: the processing is necessary for us to perform a task in the public interest or to carry out the official functions of the Fund or the LGPS, provided that the task or function has a clear basis in law.
This lawful basis applies because the administration of public sector pension schemes, such as the LGPS, is a statutory function carried out by local authorities. The processing of personal data is essential to fulfil legal obligations and deliver pension entitlements to scheme members, beneficiaries, and employers.
Where you have provided the Fund with personal data about other individuals, such as family members, dependants or potential beneficiaries under the Fund, please ensure that those individuals are aware of the information contained within this notice.
Legal basis for processing special categories of personal data
Where we obtain information concerning certain "special categories" of particularly sensitive data, such as health information, extra protections apply under the data protection legislation. We will only process your personal data falling within one of the special categories with your consent, unless we can lawfully process this data for another reason permitted by that legislation. See below for information regarding your rights.
The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR Article 9 is:
(b) Processing is necessary for the purposes of carrying out our obligations or exercising our specific rights or your rights in the field of employment and social security and social protection law
This basis is appropriate because the Fund administers pension schemes under statutory duties, including the LGPS, which falls within the scope of employment and social protection law.
(g) Processing is necessary for reasons of substantial public interest.
This may be relevant where the Fund processes data for tasks such as fraud prevention, safeguarding, or fulfilling legal obligations under public sector pension regulations.
(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
Where health data is involved (e.g. medical assessments for ill-health retirement), this lawful basis may be used. This must be carried out under legal obligations or contracts which are held between employers within the Fund and health professionals and expect to include appropriate safeguards.
Legal basis for processing criminal offence data
The Fund may process criminal offence data only when it is necessary for a legitimate purpose. When doing so, we will ensure that:
- We have a lawful basis for processing under data protection legislation; and
- We identify and apply a relevant condition from Schedule 1 of the Data Protection Act 2018, such as for employment purposes or safeguarding obligations.
Information we may process about you
To administer the Fund effectively, on occasion we may process the following categories of personal data:
- Personal identifiers: Name, date of birth, national insurance number, employee number, and contact details (address, email, phone number).
- Employment details: Information that is used to calculate and assess eligibility for benefits which may include: job title, employer name, employment history, salary information, pensionable pay, and service dates.
- Scheme membership data: Pension scheme enrolment status, contributions, benefits, and retirement details including information about your previous membership, including your date of leaving and whether the previous scheme /authority has assessed your eligibility for underpin protection.
- Financial information: Data relevant to calculation or payment of benefits for example, bank account details for pension payments, tax details, and relevant financial adjustments.
- Dependants and beneficiaries: Names, relationships, and contact details of nominated individuals, relevant to the distribution and allocation of benefits payable on death.
- Health data (special category): Where applicable, we may hold information about your health to assess eligibility for benefits payable on ill health, or where your health is relevant to a claim for benefits following the death of a member of the Fund, for example incapacity benefits.
- Criminal offence data: Information about a criminal conviction if this has resulted in you owing money to your employer or the Fund and the employer or the Fund may be reimbursed from your benefits. This may be applicable in such cases involving fraud investigations or safeguarding concerns.
All data is processed in accordance with UK GDPR and the Data Protection Act 2018, and only the minimum necessary information is used to fulfil statutory and contractual obligations.
For further information on personal data processed to administer the Fund effectively, click here to see LPPA's privacy notice.
How we obtain this data
We obtain some of this personal data directly from you. We may also obtain data (for example, salary information) from your current or past employer(s) or companies that succeeded them in business, from a member of the Fund (where you are or could be a beneficiary of the Fund as a consequence of that person's membership of the Fund) and from a variety of other sources including public databases (such as the Register of Births, Deaths and Marriages), a pensions dashboard (when you use it to access your pensions information), our advisers and government or regulatory bodies, including those in the list of organisations that we may share your personal data with set out below.
Recipients of the personal data that we process about you
To fulfil its statutory and administrative responsibilities, the Fund may share personal data with the following recipients:
| Processors | Controller |
|---|---|
| LPPA (Third party administrator) | Prudential (Additional Voluntary Contributions provider) |
| Utmost (Additional Voluntary Contributions provider) | Mercer (Fund Actuary) |
| Grant Thornton (External Auditor) | |
| Administering authorities of other LGPS funds (or their agents, such as third-party administrators) where you have been a member of another LGPS fund and the information is needed to determine the benefits to which you or your dependants are entitled | |
| Administrators of other public service pension schemes where you have been a member of another public service pension scheme and the information is needed to determine if you qualify for underpin protection | |
| The Government Actuary's Department | |
| HMRC |
From time to time the Fund may provide some of your data to your employer and their relevant subsidiaries (and potential purchasers of their businesses) and advisers for the purposes of enabling those entities to understand the liabilities and obligations of the employer regarding the Fund. Your employer would generally be a controller of the personal data shared with it in those circumstances. For example, where your employment is engaged in providing services subject to an outsourcing arrangement, the Administering Authority may provide information about your pension benefits to your employer and to potential bidders for that contract when it ends or is renewed.
The pensions dashboard framework requires the Fund through its third-party administration, LPPA, to share personal data within the dashboards ecosystem. When a member searches for information about their pensions online via a pensions dashboard, LPPA will receive certain personal data for the purposes of identifying a match with the member's pension in the Fund. LPPA then need to provide certain pensions information to the dashboards ecosystem so that it can be displayed via the relevant dashboard.
Where requested or if we consider that it is reasonably required, the Fund and/or LPPA may also provide your data to government bodies and dispute resolution and law enforcement organisations, such as the Pensions Regulator, the Pensions Ombudsman and Her Majesty's Revenue and Customs (HMRC). They may then use the data to carry out their functions.
The organisations referred to in the paragraphs above may use the personal data to perform their functions in relation to the Fund as well as for statistical and financial modelling (such as calculating expected average benefit costs and mortality rates) and planning, business administration and regulatory purposes. They may also pass the data to other third parties (for example, insurers may pass personal data to other insurance companies for the purpose of obtaining reinsurance), to the extent they consider the information is reasonably required for a legitimate purpose.
All data sharing is conducted in accordance with UK GDPR and the Data Protection Act 2018, ensuring appropriate safeguards and contractual controls are in place.
The Fund does not use your personal data for marketing purposes and will not share this data with anyone for the purpose of marketing to you or any beneficiary.
For further information on recipients of the personal data that we process about you, click here to see LPPA's privacy notice.
Transferring information outside the UK
In some cases, recipients of your personal data may be outside the UK. As such, your personal data may be transferred outside the UK to a jurisdiction that may not offer an adequate level of protection as is required by the UK Government.
If this occurs, additional safeguards must be implemented with a view to protecting your personal data in accordance with applicable laws. Please use the contact details below if you want more information about the safeguards that are currently in place.
Retention periods
The Fund will only keep your personal data as long as needed in order to fulfil the purpose(s) for which it was collected and for so long afterwards as we consider may be required to deal with any questions or complaints that we may receive about our administration of the Fund, unless we elect to retain your data for a longer period to comply with our legal and regulatory obligations.
| File type | Description | Security | Retention period |
|---|---|---|---|
| Employer contribution data | Records of contributions made by employers on behalf of members | Access-controlled systems; regular audits | Retained for 20 years |
| Fraud or investigation files | Data relating to criminal offences or investigations | Restricted access | Retained for 6 years after case closure |
| Communications, complaint correspondence and queries | Correspondence with members, employers, and third parties | Secure email | Retained for 6 years from creation |
| Employer admission agreements | Personal member data included with new employer admission agreements | Secure email, hard copies stored in secure facility. | Retained for 10 years from date employer terminated from Fund |
| Historic member pension records | Skeleton records for pension benefits transferred to another scheme | Hard copies stored in secure facility. | Retained for 100 years from date of birth |
| Historic Fund Employer records | Payment records for employer recharges | Hard copies stored in secure facility | Retained for 6 years from creation. |
Where you seek to access your pensions information via a pensions dashboard, the pensions dashboard regulations require LPPA, on behalf of the Fund, to retain different types of information (some of which includes personal data) for specific periods, as described in more detail here: www.pensionsdashboardsprogramme.org.uk/standards/data-retention-schedule
See LPPA's privacy notice for information on the retention period applied to personal data processed by LPPA on behalf of the Fund.
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
- to be informed via Privacy Notices such as this.
- to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
- of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
- of rectification, we must correct inaccurate or incomplete data within one month.
- to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
- Special category - You have the right to withdraw your consent to the processing of special category data at any time by notifying the Fund in writing. However, if you do not give consent, or subsequently withdraw it, the Fund may not be able to process the relevant information to make decisions based on it, including decisions regarding the payment of your benefits.
- to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
- to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
- to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
- in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
You can obtain further information about your rights from the Information Commissioner's Office at www.ico.org.uk or via its telephone helpline (0303 123 1113).
If you want to exercise any of these rights, or if you have any queries, complaints or concerns regarding the processing of your personal data then please contact:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address.) Provide as much detail as possible regarding your request, query, complaint or concern so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
As explained in the section above headed "Reasons for processing your personal data" and as described within LPPA's privacy notice, one of the reasons we collect and hold your personal data is to administer your pension benefits. If you do not provide the information we request or ask that the personal data we already hold is deleted or that the processing of the personal data be restricted, this may affect our ability to administer your benefits, including the payment of benefits from the Fund. In some cases, it could mean the Administering Authority is unable to put your pension into payment or has to stop your pension (if already in payment).
Updates to this privacy notice
The Fund update this notice periodically. Where the Fund does this, we will provide updated versions via the relevant online channels of the changes and the date on which the changes take effect.
Contact details of the data protection officer
- Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Further information
For more information about how we use personal information see Lancashire County Council's full privacy notice.
You also have the right to lodge a complaint in relation to this privacy notice or the Administering Authority's processing activities with the Information Commissioner's Office, which you can do at www.ico.org.uk or via its telephone helpline (0303 123 1113).