Here is our weekly summary of key legal and regulatory developments relevant to occupational pension schemes that you might have missed, with links for further information.
Recently published regulations bring many of the provisions of the Data (Use and Access) Act 2025 into force. The act introduces new data protection rules that will apply to pension scheme trustees and others involved in managing pension scheme personal data (for more information on the key issues for pension schemes, take a look at PASA’s guidance on the Act). Of particular note is the introduction of a new right for individuals to complain to “controllers” (including pension scheme trustees) if they consider that there has been a breach of data protection legislation. Controllers must facilitate the making of such complaints. The regulations state that this new right will apply from 19 June 2026. Trustees should review existing complaints procedures and check whether changes should be made to comply with the new legislation and Information Commissioner’s Office (ICO) expectations (see draft guidance issued by the ICO for further information). Amendments to privacy notices may also be required, to refer to this new right to complain.
Trustees of many schemes are required to complete their first own risk assessment (ORA) in Spring 2026. If your scheme will struggle to meet the deadline, seek legal advice on the best approach to take. Pensions partner Matthew Giles offers tips for completing the first ORA in this short video. Our factsheet and resource hub also contain useful information.
HMRC launched the Managing Pension Schemes (MPS) service back in 2018 as a replacement for the Pension Schemes Online service. However, some pension schemes have still not migrated over onto the MPS. Given that those schemes that remain on the old Pension Schemes Online platform will eventually be de-registered, and potentially suffer a consequent 55% tax charge, it is not a matter of if a scheme migrates, but when. If you are a pension trustee, please do check whether your scheme has migrated over. If you do not know whether it has, it is likely that it has not done so because this is an action that your pension schemes administrators are not able to take on your behalf. Only those persons registered as the “Scheme Administrator” (SA) on HMRC’s Pension Schemes Online platform can initiate the migration process. The SA for these purposes is not your third-party administrator, which HMRC calls a “scheme practitioner”. The SA is usually one or more of the pension scheme trustees. For more information, please get in touch with your usual firm contact.
If your pension scheme has a corporate trustee (trustee company), the trustee directors will need to complete an identity verification process before the trustee company is able to submit its next annual confirmation statement. If the trustee directors have not done this already, they can check their hard deadline for doing so by searching against their name on the Companies House website. If a person is a director of more than one company, they will need to complete their identity verification before the earliest date shown. More information on verifying a director’s identity can be found in this Companies House publication. Failure to verify your identity by the due date can result in a criminal prosecution or financial penalty. If you have any questions, please ask your usual firm contact.
If you would like specific advice on any of these issues or anything else, please contact a member of our Pensions team.
