Privacy Notice – April 2025

The North Yorkshire Pension Fund (NYPF, the Fund) is responsible for the administration of the Local Government Pension Scheme (LGPS). The service is carried out by North Yorkshire Council (NYC) who is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).

The Council has appointed Veritau to be its Data Protection Officer. Their contact details are:

Information Governance Office
Veritau
West Offices
Station Rise
York
YO1 6GA
infogov@northyorks.gov.uk
01904 552848

 The types of data we hold and process will typically include:

• Contact details, including name, address, telephone numbers and email address.
• Identifying details, including date of birth, National Insurance number and employee and membership numbers.
• Information relating to your benefits in the Fund, including length of service or membership and salary.
• Financial information in relation to your membership of the Fund to enable the calculation or payment of benefits, for example bank account and tax details.
• Information about your family, dependents or personal circumstances, for example, marital status and information relevant to the distribution and allocation of benefits payable on death.
• Information about any previous membership of other public service pension schemes and other LGPS administering authorities, including your date of leaving and whether the previous scheme/authority assessed your eligibility for underpin protection.

We may also collect certain categories of special category data:

• Information about your health, for example, to assess eligibility for benefits payable on ill health, or where your health is relevant to a claim for benefits following the death of a member of the Fund.
• Information about a criminal conviction if this has resulted in you owing money to your employer or the Fund and the employer or Fund may be reimbursed from your benefits.

Where we obtain information concerning certain ‘special categories’ of particularly sensitive data, such as health information, extra protections apply under the data protection legislation. We will only process your personal data falling within one of the special categories with your consent, unless we can lawfully process this data for another reason permitted by that legislation.

You have the right to withdraw your consent to the processing at any time by notifying the NYYPF in writing. However, if you do not give consent, or subsequently withdraw it, the NYPF may not be able to process the relevant information to make decisions based on it, including decisions regarding the payment of your benefits.

NYPF collects and processes this data to provide you and your beneficiaries with pension benefits. We will also use this personal data for statistical and financial modelling and reference purposes (for example, when we assess how much money is needed to provide members’ benefits and how that money should be invested), and to comply with our legal obligations.

We may also process your personal data to assess and, if appropriate, action a request you make to transfer your benefits out of the Fund.

The lawful basis for our use of your personal data will usually be that we need to process your personal data to satisfy our legal obligations as the Administering Authority of the Fund. However, where that lawful basis does not apply then the lawful basis for our use of your personal data will be one or more of the following:

1. UK GDPR Article 6(1)(a) The individual has given clear consent for you to process their personal data for a specific purpose. This applies to the pension portal only
2. UK GDPR Article 6(1)(b) The processing of your personal information is necessary for the performance of a contract to which you are party (employment contract). We need to process your personal data to meet our contractual obligations to you in relation to the Fund (for example, under an agreement that you will pay additional voluntary contributions to the Fund), or to take steps, at your request, before entering into a contract. 
3. UK GDPR Article 6(1)(c) We need to process your personal data to satisfy our legal obligations as the Administering Authority of the Fund.  
4. UK GDPR Article 6(1)(e) We need to process your personal data to carry out a task in the public interest or in the exercise of official authority in our capacity as a public body. 
5. UK GDPR Article 6(1)(f) We need to process your personal data for the legitimate interests of administering and managing the Fund and liabilities under it, calculating, securing and paying benefits and performing our obligations and exercising any rights, duties and discretions the Administering Authority has in relation to the Fund. 
6. UK GDPR Article 9(2)(b) The processing of your special category data is necessary for the carrying out of obligations and exercising specific rights of the data controller or of the data subject in the field of employment.  

If we need to process your personal data to comply with legal obligations or to take steps towards entering or performing an employment contract at your request, and you choose not to provide your personal data, we may be unable to enter into or continue that contract with you.

We obtain some of this personal data directly from you. We may also obtain data from your employer (for example, salary information) and from other sources including public databases and the advisers and service providers that we may share your personal data with, which are listed in this Notice.

From time to time, we will share your personal data with third parties, including our contractors, advisors, government bodies, dispute resolution and law enforcement agencies and insurers to comply with our obligations under data protection legislation, and in connection with the provision of services that help us carry out our duties, rights and discretions in relation to the Fund.

We will share your data with relevant parties in connection with any transfer of employment under TUPE (Transfer of Undertakings (Protection of Employment) regulations) that results in a transfer to another pension scheme.

In some cases, recipients of your personal data may be outside of the UK. If this occurs, we will make sure that additional safeguards are in place to protect your data in accordance with applicable data protection laws. Please contact us if you want any further information.

To comply with statutory and contractual obligations, the NYPF may share or disclose your information with any of the following recipients as may be necessary to administer the scheme:

Aon- Scheme actuary* and benefits consultant         

To calculate the value of the scheme’s assets and liabilities, to set employer contribution rates, to calculate specific benefits or to advise on scheme administration functions. (*An adviser on financial questions involving probabilities relating to mortality and other contingencies).
Aon’s Privacy Notice

Heywood Pension Technologies – Pension administration system provider
To process the McCloud remedy and meet the requirements of the Pensions Dashboard, www.pensionsdashboardsprogramme.org.uk. The dashboard is run by the Money & Pensions Service and overviewed by the Government’s Department for Work and Pensions (DWP).

Ward Hadaway – Scheme legal advisers
To prepare legal documentation in relation to new and existing employers.

Prudential – Scheme AVC provider*
To enable the creation and maintenance of individual member’s Additional Voluntary Contributions (AVC) accounts. (*The NYPF is required by law to have an AVC provider. The NYPF partners with Prudential to provide AVC options to its members. Through that arrangement, Prudential hold and process your data  to administer your AVC account).

Citibank – Overseas payments provider
To transmit payments to scheme members with non-UK bank accounts.

Local Government Association – LGPS National Insurance database
To enable the NYPF to identify if its members have benefits in other LGPS schemes to ensure that appropriate benefits are paid.

Department for Work and Pensions – DWP Tell Us Once service
To enable the NYPF to be notified of the death of a scheme member.

Capita Pension Solutions Limited – Life existence checks and address tracing
To enable the NYPF to be notified of the death of scheme members and to pay pension benefits.

Veritau Ltd and Mazars – Scheme auditors
To enable the audit of processes, calculation of benefits and scheme governance arrangements.

Government Actuary’s Department – National LGPS cost
To facilitate the calculation of the triennial assessment of the cost of the LGPS on a national basis as per the Public Service Pensions Act 2013.

National Fraud Initiative
To enable the cross-checking of records from other pension schemes and the DWP by the Public Sector Fraud Authority to identify fraudulent benefit claims.

Other LGPS administering authorities – Scheme managers of other LGPS funds
To determine pension benefit entitlements.

 We will only keep your personal data for as long as we need it to administer the Fund and to deal with any questions or complaints that we may receive about this, unless the law requires us to keep it for a longer period. In practice, this means that your personal data may be retained for the greater of:

• such period as you (or any beneficiary who receives benefits after your death) are entitled to benefits from the Fund and for a period of 15 years after those benefits stop being paid. For the same reason, personal data may also need to be retained where we have received a transfer, or paid a refund from the Fund; or
• 100 years from your date of birth or
• 100 years from the date of birth of any beneficiary who received benefits from the Fund after your death

Paper documentation will be retained for 30 years. At the end of the retention period it will be shredded.

When we retain personal data, we will keep it up to date and take all reasonable steps to ensure that inaccurate data is either erased or corrected without delay. We will periodically review the personal data that we retain and consider whether it is still required; any personal data that we no longer require will be destroyed.

For more information about how the Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.