You are here: Home | Publications | Policy documents | privacy policy | Privacy policy and data protection

Privacy policy and data protection


This privacy policy has been prepared for the Lothian Pension Fund (the Fund) (acting through its administering authority the City of Edinburgh Council (the Council)) and its group companies LPFI Limited (LPFI) and LPFE Limited (LPFE) (together the LPF Group).

The Fund is a Local Government Pension Scheme which administers pensions on behalf the Fund’s c.90 employers and c.81,000 members.

To provide pension services to our members and scheme employers, we collect, store, use, share, and dispose of personal data. This is known as data processing. Because the Fund decides how and why the processing is carried out, it is also a data controller.

The LPF Group carries out its data processing activities in compliance with the EU General Data Protection Regulation and the UK Data Protection Act (together “data protection law”). Under data protection law, Data Controllers must be open and accountable to individuals about how their data is stored, controlled, and processed. The LPF Group is committed to protecting the privacy of all the Fund’s members and we have prepared this privacy policy to comply with our obligations under the law.

This privacy policy sets out:

- The types of data the LPF Group collects and holds.

- Why we process your data.

- How we process your data.

- Who we share it with.

- Your rights under data protection law.

By law, we must also register with the UK Information Commissioner’s Office as a data controller. The Fund’s data controller registration number is currently ZA114237.

This policy has been prepared in accordance with data protection law. Any changes to this policy in the future will be posted on this page and, where appropriate, notified to you by post or email. Please check back frequently to see any updates or changes to this privacy policy. Regularly reviewing this page will ensure you are always aware of what we are doing with your personal data. We will nevertheless communicate changes in policy to you.

Who is a data subject?

We have identified the following categories of people as “data subjects”. Data subjects are defined by data protection law as individuals whose data we hold:

- active members of the Fund;

- potential beneficiaries;

- pensioners;

- former members of the Fund;

- deferred members of the Fund; and

- ex-spouses of members of the Fund.

What information does the LPF Group collect about me?

We may collect and process the following data about you:

  • Information that you provide to us, such as by filling in forms on our site or, and includes information provided at the time of registering to use, subscribing to receive e-newsletters or other service, posting material or requesting further services.
  • We will keep records of correspondence you send to us as appropriate.
  • We may ask you to take part in customer feedback to improve our services.
  • Details of any services you request or amendments you make during visits to for audit purposes.
  • Details of your visits to our online services, including your IP address.
  • Any of the above information may include:
    • your name, address, email address, phone number;
    • date of birth;
    • sex;
    • marital status, dependents, next of kin;
    • financial information: bank account details, payroll records, tax information, salary, pension contributions, benefits;
    • employment information: start dates, retirement dates, name and location of your employer, job titles, work history, NI number; and
    • limited health information: whether you are eligible for ill-health early retirement (we would not normally require information on the underlying medical assessment to determine whether you are eligible).


The web site does store cookies on your computer, but these do not contain personal data or anything that could identify you to others. You can opt out of accepting cookies on our website.  Read about our cookies policy here.

Data from Third Parties

In addition to the information you provide us, we may also receive personal data about you from other sources, such as:

  •  your employer;
  •  occupational health providers (note that they will not provide us with your medical records);
  •  Standard Life / Prudential AVC providers;
  •  registrars;
  •  solicitors;
  •  your previous pension scheme; and
  •  HMRC.

Why can the LPF Group process my personal data?

Data protection law says that Data Controllers may only process personal data if they have a lawful basis to do so. Depending on the exact nature of the personal data and the reasons for processing it, the lawful basis may change. However, under the applicable law and regulations governing the Group’s activities, we have a duty to provide and administer pensions for our members and to invest and safeguard the assets of the Fund. So, usually, the reason we process your personal data is so that we can carry out our legal duties.

Other reasons we might need to process your personal data are:

   - we need to meet a contractual obligation to you;

   - we need to provide your data to government organisations such as HMRC or the DWP to assist them in 
     safeguarding public funds; and

   - the detection and prevention of fraud.

Does the LPF Group need my consent to process my personal data?

No - because of our legal obligation under the applicable Local Government Pension Scheme Regulations in Scotland, we do not require the express consent of our members in order to process their personal data for this purpose. If the Fund could not process this personal data, we would not be able to carry out our legal duties. This equally applies to any data identified under Article 9 of the GDPR as being “special category personal data”.

How does the LPF Group process my personal data?

We use information held about you to administer your pension benefits which includes, but is not limited to, the following:

  • To carry out routine day-to-day pensions administration tasks in relation to your benefits, such as benefit calculation and eligibility assessment. To perform statistical and financial analysis to inform our investment decisions and actuarial analysis.
  • To comply with our legal and regulatory obligations as administering authority of the Fund.
  • To address queries from members and resolve disputes concerning the Fund.
  • To manage the Fund’s liabilities and insurance.
  • To provide annual statements and other information regarding your benefits.
  • To notify you about changes to our service.
  • To ensure that content from our websites is presented in the most effective manner for you and for your computer.
  • To provide you with other information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes by email.
  • We may also use your data to provide you with information about goods and services from us or our partner organisations which may be of interest to you, and we may contact you about these by post or telephone.
  • To prevent fraud in relation to your pension benefits.

Storage & Retention

Your data will be stored securely by the Fund’s pensions administration software provider, Heywood Limited. Their registered address is Aquila House, 35 London Road, Redhill, Surrey RH1 1NJ. Your data may also be hosted on the Council's corporate network, in accordance with the LPF Group’s Records Management Policy.

Your data will not be kept for any longer than it is needed by the Fund to carry out our processing activities. Paper and electronic records will be disposed of in a secure way. The exact length of time we keep your data will depend on the purpose for which it is collected. The Fund has a Records Retention Schedule which governs how long your records will be kept.

What are my rights?

You have the right to request access to any data which we may keep on you. If any information kept about you turns out to be inaccurate or incomplete, you have the right to request that the information be corrected.

You have the right to ask us not to process your personal data for marketing purposes. We will usually inform you (before collecting your data) if we intend to use your data for these purposes or if we intend to disclose your information to any third party for these purposes. We will give you the opportunity to opt out of any marketing materials when we send them.

If you have left the Fund and feel there is no reason for us to continue to process your data, or if you believe your data is being processed unlawfully, you have the right to request that we delete any information held about you.

In certain circumstances, you have the right to restrict processing of your data, meaning the LPF Group will keep your information on file, but will be unable to do anything with it until the restriction is lifted. Processing will be restricted while the Fund corrects information which is inaccurate, while we process a request to have your data deleted and where the Fund no longer has a reason to process your data but you require it to establish, exercise or defend a legal claim.

You will not normally have to pay a fee to exercise any of these rights, however we may charge you for our administrative costs in certain cases if the request is particularly excessive of if you request further copies of your data.

The right to lodge a complaint with the Information Commissioner’s Office (ICO) if you feel your data is not being handled properly. More information on how to do this can be found here.

More general information and advice on Data Protection is also available on the ICO’s website here.

Who does LPF share my personal data with?

To carry out our duties, we may have to share your data with certain third parties, including:

Who does LPF share my personal data with?
Type of Service Name of 3rd Party/Parties Reasons for sharing the personal data
Scheme Actuary Hymans Robertson Calculation of the Fund’s assets and liabilities and setting employer contribution rates.
Scheme AVC Providers Prudential
Standard Life
Creating individual member AVC accounts.
Scheme Auditor Scott Moncrieff

 Auditing the Fund and LPF Group companies’ Annual Reports and accounts.

Auditing the Fund and LPF Group companies’ internal controls.

LGPS National Insurance Database South Yorkshire Pensions Authority Identifying if Fund members have benefits in other LGPS schemes.
DWP Tell Us Once Service Department for Work and Pensions Notifying the Fund of the death of scheme members.
Regulators, the government, law enforcement bodies, including local and foreign courts, tribunals, and arbitrators.

 The Pensions Regulator

Government Actuary Department

The Scheme Advisory Board

National Fraud Initiative

Complying with the Fund’s statutory obligations.
The Joint Investment Strategy Panel (JISP) The JISP consists of a representative of Falkirk Council Pension Fund, 2 independent investment advisors and 1 institutional investment advisor. To assist the Fund in determining investment strategy based on its liabilities as determined by its membership and employer profile.
The Fund’s pensions administration software provider Aquila Heywood Providing the Fund with technical and management support for its electronic pensions administration systems

Some of these third parties may store personal data outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, such transfers will be in full compliance with data protection legislation.

Data Protection Officer & Complaints

The Fund must appoint a Data Protection Officer to make sure we are complying with data protection law. The Fund’s Data Protection Officer is currently:

Kevin Wilbraham, the Council’s Information Governance and Strategic Complaints Manager

Information Governance Unit

City of Edinburgh Council

Waverley Court - 2.1

4 East Market Street



Email: | Tel: 0131 469 6200

Should you have any complaints or comments about our processing and use of your personal data, or if you wish to report an incident, please contact:

Struan Fairbairn, Chief Risk Officer of the Lothian Pension Fund

Atria One

144 Morrison Street



Email: | Tel: 0131 529 4638

and the Fund’s Data Protection Officer.

If you still have concerns about the processing and use of your personal data, you can contact:

UK Information Commissioner’s Office

Wycliffe House

Water Lane




08456 30 60 60

This Privacy Policy was last updated on 25 May 2018.