This privacy policy has been prepared for the members and beneficiaries of Lothian Pension Fund (the Fund). The Fund is a Local Government Pension Scheme which administers pensions on behalf of c.70 employers and c.81,000 members.   

The administering authority of the Fund is the City of Edinburgh Council. City of Edinburgh Council is also the data controller of the Fund and is registered with the Information Commissioner’s Office under registration number Z5545409.

This privacy notice is available on the Fund’s website. It is important that you read this privacy notice together with any other privacy notice or fair processing policy we provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice replaces any version previously issued and supplements any other notices and privacy policies we issue that are specific to particular data collection/ processing activities.

To provide pension services to our members and scheme employers, we collect, store, use, share, and dispose of personal data.  This is known as data processing.  The Fund processes your data (and personal data relating to your beneficiaries) in order to contact you, to calculate, secure and pay your benefits, for statistical and financial modelling and for reference purposes (for example, when we assess how much money is needed to provide members' benefits and how that money should be invested), and to manage liabilities and administer the Fund generally.

The Fund carries out its data processing activities in compliance with:

  • UK Data Protection Act 2018;
  • UK GDPR (as defined in the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019/419); and
  • to the extent relevant, the General Data Protection Regulation 2016/679

(together “data protection law”).  Under data protection law, we must be open and accountable to individuals about how their data is stored, controlled, and processed. 

This privacy policy sets out:

  • The types of data the Fund collects and holds.
  • Why we process your data.
  • How we process your data.
  • Who we share it with.
  • Your rights under data protection law.

Any future changes to this policy will be posted online and, where appropriate, notified to you by post or email.  Regularly reviewing this page will ensure you are always aware of what we are doing with your personal data but we will communicate material changes to the policy to you.

Who is a data subject?

Data subjects are defined by data protection law as individuals whose data we hold. We have identified the following categories of people as “data subjects” and this policy will apply to all of them:

  • active members of the Fund;
  • members of the Fund in receipt of their pension;
  • deferred members of the Fund;
  • beneficiaries and potential beneficiaries of members of the Fund;
  • former members of the Fund; and
  • ex-spouses of members of the Fund.


What information does the Fund collect about me?

The information about you which we collect and process may include:

  • Name
  • National Insurance Number
  • Date of Birth
  • Gender
  • Contact details: email address, telephone numbers, residential address, including postcode
  • Date joined/left the Fund
  • Marital/partnership status
  • Previous transfers of pension rights
  • Annual allowance information – pension inputs
  • Employment history (start dates, retirement dates, name and location of your employer, job titles, work history)
  • Bank account details
  • Pension entitlement
  • Beneficiary details
  • Information relevant to the distribution and allocation of benefits payable on death (i.e. survivors’ benefits)
  • Pensionable pay
  • Tax information
  • Limited health information: whether you are eligible for ill-health early retirement (we would not normally require information on the underlying medical assessment to determine whether you are eligible) or where your health is relevant to a claim for benefits following the death of a member of the Fund
  • Information about a criminal conviction if this has resulted in you owing money to your employer or the Fund and the employer or Fund may be reimbursed from your benefits
  • Contribution rate
  • Guaranteed Minimum Pension details

The information may include sensitive personal data including but not limited to, your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or data concerning their physical or mental health or condition or sexual orientation.

We obtain some of this personal data directly from you by asking you to fill in forms on our website (and to register to use such website) or to subscribe to receive e-newsletters or other services. We may also ask you to take part in customer feedback to improve our services. 

We will keep:

  • details of any services you request or amendments you make during visits to our website;
  • details of your visits to our online services, including your IP address; and
  • records of correspondence you send to us, where appropriate.


When we are in contact with you by phone, we will collect and store your phone number and a recording of the call.

Data from Third Parties

In addition to the information you provide us, we may also receive personal data about you from other sources. We may obtain data (for example, salary information) from your current or past employer(s) or companies that succeeded them in business, from a member of the Fund (where you are or could be a beneficiary of the Fund as a consequence of that person's membership of the Fund) and from a variety of other sources including public databases (such as the Register of Births, Deaths and Marriages), our advisers and government or regulatory bodies.


Occupational health providers, AVC providers, solicitors, your previous pension scheme, and HMRC may also provide us with your personal data.

Why can the Fund process my personal data? 

Data protection law provides that Data Controllers may only process personal data if they have a lawful basis to do so.  Depending on the exact nature of the personal data and the reasons for processing it, the lawful basis may change.  However, under the applicable law and regulations governing the Fund’s activities, we have a duty to provide and administer pensions for our members and to invest and safeguard the assets of the Fund.  So, usually, the reason we process your personal data is that we need to do so to satisfy our legal obligations as the administering authority of the Fund. 

However, where that legal basis does not apply then the legal basis for our use of your personal data will be one or more of the following:

  • we need to process your personal data to carry out a task in the public interest or in the exercise of official authority in our capacity as a public body; and/or
  • we need to process your personal data for the legitimate interests of administering and managing the Fund and liabilities under it, calculating, securing and paying benefits and performing our obligations and exercising any rights, duties and discretions the Administering Authority has in relation to the Fund; and/or
  • because we need to process your personal data to meet our contractual obligations to you in relation to the Fund (for example, under an agreement that you will pay additional voluntary contributions to the Fund), or to take steps, at your request, before entering into a contract.

Does the Fund need my consent to process my personal data?

No. As mentioned above, the data processing carried out by the Fund is necessary for compliance with the Fund’s legal obligations, being the statutory duties and powers set out in the legislation applicable to local government pension schemes in Scotland. For such reason, we do not require the express consent of our members in order to process their personal data for this purpose.  If the Fund could not process this personal data, we would not be able to carry out our legal duties.

This equally applies to any data identified as being “special category personal data”.  Where we obtain information concerning certain "special categories" of particularly sensitive data, such as health information, extra protections apply under the data protection legislation. We will only process your personal data falling within one of the special categories with your consent, unless we can lawfully process this data for another reason permitted by that legislation. You have the right to withdraw your consent to the processing at any time by notifying us in writing. However, if you do not give consent, or subsequently withdraw it, we may not be able to process the relevant information to make decisions based on it, including decisions regarding the payment of your benefits.

Where you have provided us with personal data about other individuals, such as family members, dependants or potential beneficiaries under the Fund, please ensure that those individuals are aware of the information contained within this notice.

How does the Fund process my personal data?

We use information held about you to administer your pension benefits, including:

  • To carry out routine day-to-day pension administration tasks in relation to your benefits, such as benefit calculation and eligibility assessment.
  • To perform statistical and financial analysis to inform our investment decisions and actuarial analysis.
  • To comply with our legal and regulatory obligations as administering authority of the Fund.
  • To assess and, if appropriate, action a request you make to transfer your benefits out of the Fund.
  • To address queries from members and resolve disputes concerning the Fund.
  • To manage the Fund’s liabilities and insurance.
  • To provide annual statements and other information regarding your benefits.
  • To allow alternative ways of delivering your benefits, for example, through the use of insurance products and transfers to or mergers with other pension arrangements.
  • To notify you about changes to our service.
  • To ensure that content from our websites is presented in the most effective manner for you and for your computer.
  • To provide you with other information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes by email.
  • To prevent fraud in relation to your pension benefits.

Storage & Retention

Your data will not be kept for any longer than it is needed by the Fund to carry out our processing activities.  Paper and electronic records will be disposed of in a secure way.  The exact length of time we keep your data will depend on the purpose for which it is collected. 

The Fund has a Records Retention Schedule which governs how long your records will be kept. In practice, this means that your personal data will be retained for such period as you (or any beneficiary who receives benefits after your death) are entitled to benefits from the Fund and for a suitable period after those benefits stop being paid. For the same reason, your personal data may also need to be retained where you have received a transfer, or refund, from the Fund in respect of your benefit entitlement.

Your data will be stored securely by the Fund’s pensions administration software provider, Heywood Limited.  Their registered address is Aquila House, 35 London Road, Redhill, Surrey RH1 1NJ.  Your data may also be hosted on LPF’s corporate network, in accordance with the Fund’s Records Management Policy.

What are my rights?

You have the right to request access to any data which we may keep on you. If any information kept about you turns out to be inaccurate or incomplete, you have the right to request that the information be corrected. In very limited circumstances, you may also have a right to ask the us to restrict the processing of your personal data, or to transfer or (in extremely limited circumstances, such as where your personal data is no longer needed for the purpose for which it is being processed) erase your personal data. You should note that we are not obliged to erase your personal data if we need to process it for the purposes of administering the Fund.

In certain circumstances you have the right to object to the processing of your personal data; for example, you have the right to object to processing of your personal data which is based on the public interest or legitimate interests identified in the section above headed ‘Why can the Fund process my personal data?

As explained above, one of the reasons we collect and hold your personal data is to administer your benefits. If you do not provide the information we request, or ask that the personal data we already hold is deleted or that the processing of the personal data be restricted, this may affect our ability to administer your benefits, including the payment of benefits from the Fund. In some cases, it could mean we are unable to put your pension into payment or has to stop your pension (if already in payment).

You will not normally have to pay a fee to exercise any of these rights, however we may charge you for our administrative costs in certain cases if the request is particularly excessive or if you request further copies of your data.

If you wish to exercise any of these rights or have any queries or concerns regarding the processing of your personal data, please contact use using the details provided below. You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you feel your data is not being handled properly. More information on how to do this can be found here.

Who does LPF share my personal data with?

From time to time we will share your personal data with advisers and service providers so that they can help us carry out our duties, rights and discretions in relation to the Fund.  Some of those organisations will simply process your personal data on our behalf and in accordance with our instructions; they are referred to as processors. Other organisations will be responsible to you directly for their use of personal data that we share with them; they are referred to as controllers.  In each case we will only do this to the extent that we consider the information is reasonably required for these purposes.

Whenever one of our advisers or service providers acts as a joint controller with us in respect of your personal data, because we jointly determine the purposes and means of processing it, we will agree with them how we are each going to meet our respective and collective obligations under the data protection law. If you would like more information about how such an arrangement works please contact us using the contact details below.

The organisations that we may share your personal data with may include the following advisers and service providers:

  • Aquila Heywood provides the Fund’s pensions administration software, giving the Fund with technical and management support for its electronic pensions administration systems.
  • Club Vita LLP provides longevity (life expectancy) analytics and related information for the purpose of helping us to manage the Fund’s liabilities.
  • Hymans Robertson provides Scheme Actuary services for the purpose of calculating the Fund’s assets and liabilities and setting employer contribution rates.
  • Hymans Robertson LLP and Club Vita LLP may appoint service providers or sub-processors to help in the provision of their services. For details, please visit:
  • PAM provides occupational health service in connection with matters such as ill-health retiral applications for deferred members.
  • Prudential and Standard Life provide scheme AVCs and create individual member AVC accounts.  
  • Azets provides audit services for the Fund’s annual reports and accounts.
  • South Yorkshire Pensions Authority provides the LGPS National Insurance Database for the purpose of identifying if Fund members have benefits in other LGPS schemes.
  • Department for Work and Pensions (DWP) provides the Tell Us Once Service for the purpose of notifying the Fund of the death of scheme members.
  • The Pensions Regulator, Government Actuary Department, The Scheme Advisory Board and National Fraud Initiative are some of the regulators, government or law enforcement bodies with whom we may share data to comply with the Fund’s statutory obligations.
  • Crown Agents Bank facilitates overseas payments by the Fund, to administer benefit payments to scheme members with non-UK accounts as well as our annual Proof of Life exercise.
  • Administering authorities of other LGPS funds (or their agents, such as third-party administrators), depending on circumstances, where a member has been a member of another LGPS fund, and the information is needed to determine the benefits to which the member or their dependants are entitled.
  • Credit reference agencies, including TransUnion, for identity verification and fraud prevention purposes. TransUnion’s relevant privacy policy and further information about TransUnion’s activities is available
  • Tracing bureaus for mortality screening and locating members and beneficiaries. The Fund uses Crown Agents Bank, a third party service provider of a solution that provides accurate and efficient identity verification when members complete Proof of Life checks using integrated biometric facial authentication technology without a requirement for third party attestation. More details on how Crown Agents Bank handle personal data are available here:
  • Suppliers of IT services.
  • The Courts - for the purpose of processing pension sharing orders on divorce.

From time to time we may provide some of your data to your employer and their relevant subsidiaries (and potential purchasers of their businesses) and advisers for the purposes of enabling those entities to understand their liabilities and obligations to the Fund. Your employer would generally be a controller of the personal data shared with it in those circumstances. For example, where your employment is engaged in providing services subject to an outsourcing arrangement, we may provide information about your pension benefits to your employer and to potential bidders for that contract when it ends or is renewed.

Where requested or if we consider that it is reasonably required, we may also provide your data to government bodies and dispute resolution and law enforcement organisations, including those listed above, the Pensions Regulator, the Pensions Ombudsman and Her Majesty's Revenue and Customs (HMRC).  They may then use the data to carry out their legal functions.

Some of these third parties may store personal data outside the United Kingdom. Where personal data is transferred outside the UK, we review whether the relevant jurisdictions offer an adequate level of protection to personal data, as is required by the UK Government, to ensure such transfers will be in full compliance with data protection legislation. Additional safeguards may be implemented with a view to protecting your personal data in accordance with applicable laws. Please use the contact details below if you want more information about the safeguards that are currently in place.

We do not use your personal data for marketing purposes and will not share this data with anyone for the purpose of marketing to you or any beneficiary.

Contacting us

Please use one of the following methods to contact us for further information:

By email:

By telephone: 0131 529 4638

By mail - Lothian Pension Fund, PO Box 24158, EDINBURGH, EH3 1GY


Data Protection Officer

The Fund’s Data Protection Officer is currently Kevin Wilbraham, City of Edinburgh Council’s Information Governance and Strategic Complaints Manager, Information Governance Unit, City of Edinburgh Council, Waverley Court - 2.1, 4 East Market Street, Edinburgh EH8 8BG, Email: Tel: 0131 200 2340.


If you still have concerns about the processing and use of your personal data, you can contact UK Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Tel: 08456 30 60 60.


This Privacy Policy was last updated in June 2022.

My Pension Online