10 actions for getting to grips with pensions dashboards

The Dashboards Regulations originally set out multiple connection deadlines, with the largest master trusts due to connect in August 2023 and other schemes connecting on successive prescribed dates, depending on their size and type. However, the DWP announced in March 2023 that additional time was needed for connection. The Dashboards Regulations were amended in July 2023, so that they set out a single statutory connection deadline of 31 October 2026 for all schemes with 100 or more relevant members at the scheme year end between 1 April 2023 and 31 March 2024.

In March 2024, the DWP published connection guidance, which includes a staged timetable for pension schemes and providers to connect to the pensions dashboards ecosystem and be in a position to process 'find' and 'view' requests. The guidance retains the original plan for staged connection dates, ahead of the statutory connection deadline of 31 October 2026. Dates are determined based on scheme type and number of relevant members (also measured as at the scheme year end between 1 April 2023 and 31 March 2024).

Some key dates are as follows:

• The earliest date is 30 April 2025, which is for defined contribution (DC) master trust schemes with 20,000 or more relevant members and FCA-regulated operators of a personal pension scheme with 5,000 or more relevant members.
  
  
• The earliest date for other DC schemes is 31 May 2025, which is for DC schemes used for automatic enrolment with 5,000 or more relevant members and other DC schemes with 20,000 or more members.
  
  
• The earliest date for schemes without DC benefits is also 31 May 2025, which is for such schemes with 20,000 or more members (but not public service or parliamentary schemes).
  
  
• The earliest date for hybrid schemes is also 31 May 2025, for such schemes with 20,000 or more members.
  
  
• The single date for collective DC schemes is 30 September 2025.
  
  
• The single date for public service pension schemes and parliamentary pension schemes is 31 October 2025.
  
  
• The latest date is 30 September 2026, which is for any schemes with between 100 and 124 relevant members. (Schemes with fewer than 100 members are not required to connect but may do so voluntarily.)

Whilst the guidance is clear that it is not mandatory and the obligation in the legislation is to "have regard" to it, in practice our view is that it is likely to be difficult to justify connecting later than the dates specified in the guidance in all but very rare cases.  The DWP encourages schemes and providers to follow the guidance "unless there are exceptional circumstances which prevent them from doing so". The guidance says that having regard to it means that "trustees or managers and pension scheme providers must take the guidance into account when preparing to connect to the pensions dashboards ecosystem."

It goes on to say:

"It is a legal requirement for trustees or managers and pension scheme providers to have regard to this guidance as part of meeting their obligations and not doing so would be a breach of this requirement. As such, trustees or managers and pension scheme providers must consider it when making decisions or taking actions in relation to preparing to connect to dashboards.

Trustees or managers and pension scheme providers will need to be able to demonstrate, upon request, how they have had regard to this guidance. This means, but is not limited to:

• • Not making final decisions about connecting before engaging with this guidance.
    
    
  • Being able to demonstrate that adequate governance and processes for making such decisions are in place. The reasoning for decisions should be clearly considered and documented, as well as how relevant risks are identified, evaluated, and managed.
    
    
  • Making sure that access is available to all relevant information before making decisions and acting upon them. Keep clear and accurate audit trails to demonstrate the decisions made, the reasons for them and the actions taken.

If trustees or managers and pension scheme providers are unable to demonstrate how they have had regard to the guidance, this may result in enforcement action by the relevant regulator."

The Pensions Regulator has updated its "Pensions dashboards: initial guidance" to reflect the staging timetable and has urged schemes to coordinate with their third party suppliers and advisers to ensure they are on track to comply with the new regime: "There is significant work involved to comply with your dashboards duties and you may need to engage third-party suppliers to help you with this work, such as an administrator or an integrated service provider (ISP). You should work with your advisers to assess the impact of the changes and plan how you will meet your dashboard duties." The updated guidance includes an online tool to help schemes identify how the staged timetable applies to them.

The PDP has also stressed the importance of schemes connecting by their guidance date, in order to manage the volume and flow of connections in a stable manner. It adds that this will also support more extensive user testing and make it possible to launch the service to the public as soon as possible.

Schemes that will miss their guidance connection date are encouraged to engage with the PDP and the Pensions Regulator.

Applications to defer the connection deadline are only required where the deferral is to a date after the statutory deadline, 31 October 2026, and can only be made before 8 August 2024 in relation to very limited circumstances, involving a change of administrator or contractual retendering requirement (see Action 6 (Outsourcing arrangements), below).

Occupational pension schemes will be required to register and cooperate with MaPS in connecting with the dashboard infrastructure and responding to "find and view" requests (see above). Schemes should be in contact with their administrators or software providers about how to do this.

There are two connection options: connecting directly or connecting via a third party. The PDP expects that most schemes will connect via a third-party data provider, which will mean that they can register their connection to the existing endpoint provided by that third party. It states in the "Connection process and guidance" that schemes "should allow up to 30 working days to complete registration and connection via an already-connected third party". However, if schemes intend to connect directly by setting up a new live endpoint, the PDP recommends that they should start this process six to nine months before they need to connect.  Schemes will need to consider the updated staging timetable and  assess the implications of this for their connection process.

Schemes will need to comply with pre-connection steps. The PDP has issued "Code of Connections" standards, which set out its expectations on security, service and operational standards, alongside recommended or best practice guidance and "Early connection guidance" (see Action 10 (Monitoring industry developments), below).

Once individuals start accessing the dashboards, schemes will need to be able to match "find" requests from dashboard users against their records, identify relevant individuals and send data back to dashboards within the prescribed response times (see Action 2 (Data), above).

Ahead of this, schemes will need to decide on their criteria for matching find requests. PASA data matching convention guidance (updated in August 2022, with an addendum in March 2023) will help with this. The Pensions Regulator's guidance also addresses matching, which suggest that schemes may wish to refer to PASA's guidance when deciding on their approach to matching.

PASA has suggested that, based on current practice, many (but not all) schemes will decide to match based on three core data elements: surname, date of birth and National Insurance Number. Some schemes may add the user's first name as a fourth data element.

Schemes will need to be confident that any data elements they use are accurate. This is likely to be challenging where they rely on third parties, such as employers, deferred members or previous administrators. Wider data protection and security considerations will also be highly relevant here (see Action 7 (Data protection and cyber security), below).

Schemes could face significantly more requests from members once dashboards are launched. This could take the form of members seeking to correct their personal data so their pensions can be found, requests for more accurate retirement figures or transfer value quotations or follow-up queries from members who have been reconnected with their pensions. Schemes will need to check that administrators have capacity to deal with these demands (see Action 6 (Outsourcing arrangements), below).

If schemes (particularly DB schemes) find that they are receiving greater demands from members to transfer their benefits after accessing a dashboard, both trustees and scheme sponsors may want to review the support they provide for these decisions together with their existing transfer processes (including scams checks and nudges to pension guidance, where applicable).

Communications strategies may also need to be updated to cover dashboards – including to explain what members can expect to see and do through the dashboards platform. For example, in many cases dashboards will not be able to fully reflect a member's actual pension entitlement under a scheme because of the various benefit complexities that may exist (such as underpins, tranches of benefits, early and late retirement options, etc). Managing member expectations and the risk of legal liability arising from reliance on figures given via the dashboards will be critical.

Most schemes will require input from third party service providers to ensure they can meet the new dashboard requirements. In particular, schemes may need assistance in establishing access to scheme data via the dashboards, developing search functionality and ensuring that new systems and processes are appropriate and robust.

In the first instance this is likely to involve conversations with scheme administrators and software providers to explore project plans and identify any additional resource or support requirements and any need for further expertise to be brought in. A key part of this assessment will be a review of the terms of existing outsourcing contracts to ensure they remain fit for purpose once the dashboards regime is in place. As a minimum, this review should cover the following:

• Service descriptions – are these sufficiently broad to capture the transition to dashboards and compliance with the regulatory framework? Even if the answer is yes, should service descriptions be updated to reflect the detail of the regime or a change to existing practice?
  
  
• Service levels – should existing KPIs be updated (or supplemented) to align with:
  
  
  • regulatory obligations in relation to the quality of data and acceptable response times?
  • new standards and guidance issued by MaPS or the Pensions Regulator, including obligations to retain management information (see also Action 9 (Record keeping and reporting) below)?
  • changes to the scheme's own risk management processes or other policies?

Any updates need to be realistic, both in view of the provider's resources and technological expertise and the likely uptick in member requests (see also Action 5 (Preparing to engage with members) above).

• Cost allocation – what are the costs of providing any new services? Does the contract provide any guidance on how the costs should be allocated between the parties and/or any associated protections (e.g. caps, benchmarking rights)? How could the costs change as the regime evolves?
  
  
• Liability – how will the risks associated with the new regime (e.g. regulatory fines or other costs associated with any breach) be allocated between the scheme and the provider? What steps should the parties take to mitigate the risk of any such liabilities arising?
  
  
• Implementation – is the provider planning to use a third party solution or develop its own in-house? What milestones or other controls should be in place to give the trustees confidence that the implementation project is on track and that development work will not compromise service standards in the meantime?
  
  
• Data – What new data protection and cyber security risks will arise under the new arrangements and how will these be addressed and apportioned (see also Action 7 (Data protection and cyber security?) below)?

By their nature, any changes to the outsourcing arrangements will need to be made in collaboration with the service providers. Trustees should engage with administrators and IT suppliers at an early stage to understand their technical proposals for connecting to the dashboard ecosystem.

Schemes that are changing administrator (or are contractually required to retender the administration of the scheme) will also need to consider how this could affect their ability to comply with the new regime. The DWP's connection guidance recognises that such a change may make it "excessively burdensome" to connect to the pensions dashboards ecosystem by the dates set out that guidance. The DWP acknowledges that, provided that connection is completed before 31 October 2026, the Dashboards Regulations do not require schemes to make a formal application to defer connection if trustees or managers do not believe it is possible to connect by the dates set out in this guidance because of a change of administrator. The DWP nevertheless recommends that trustees or managers should communicate their plans with the PDP and the Pensions Regulator at the earliest opportunity.

The Dashboards Regulations also allow schemes some flexibility to apply to defer the connection deadline of 31 October 2026 by up to 12 months where it would be disproportionately burdensome (or would put the personal data of members at risk) to comply as a result of a procurement process for a new administrator (or administration system) which had begun before 9 August 2023. However, that extension is unlikely to be granted where the incoming administrator is already "dashboard-ready". The DWP has issued guidance on applying for a deferral. The latest date for making such an application is 8 August 2024.

Schemes will need to comply with their responsibilities as data controllers under the UK General Data Protection Regulation (UK GDPR) and the guidance set out in the Information Commissioner's statutory code of practice on data sharing and consider the following:

• Legal basis for processing – there must be a legal basis for each processing activity. MaPS (through CAS) will obtain an individual's consent to their data being sent to the scheme to search for that individual's benefits following a find request. Consent can be withdrawn and, while this process is likely to be managed centrally through CAS, schemes will need to ensure that no further data is shared if this occurs. In responding to the find request, schemes should be able to rely on the legal basis of "compliance with a legal obligation" to match the individual and then return view data to them (on the basis of its regulatory obligation to respond to a request) or, alternatively, "legitimate interests". Schemes should make a record of the legal basis on which they rely.
  
  
• Transparency obligations – schemes will need to update privacy policies to cover all requirements of UK GDPR, including reflecting the legal basis for processing and data sharing arrangements.
  
  
• Accurate data – a key risk for schemes from a data protection perspective is the disclosure of data to the wrong person and, in setting their matching criteria, schemes will need to balance duties under the UK GDPR with obligations under the new dashboard regime (see Action 4 (Getting ready to match) above). This ultimately comes down to getting your data in order (Action 2 (Data)): the more accurate the data that the scheme holds, the better the prospect of complying with both regimes.
  
  
• Security – schemes are responsible for protecting personal data with adequate security measures. The cyber security standards with which those connecting to the dashboards must comply are yet to be published but are expected to be robust. Prior to sharing data, schemes may wish to carry out a data protection impact assessment (DPIA) to ensure that risks are identified and mitigated accordingly (especially in view of sensitivity of data to be disclosed). The DPIA to be published by the PDP for the dashboard ecosystem should help with this.
  
  
• Managing processors – while it is unclear what data sharing agreements, if any, will be managed centrally, schemes will need to work with administrators and software providers to ensure that new requirements are reflected adequately under the relevant contracts (see Action 6 (Outsourcing arrangements)).

Existing scheme risk management processes should be reviewed and updated to ensure that they will:

• comply with the new dashboard requirements;
• address new risks concerning data protection and cyber security (see Action 7 (Data protection and cyber security), above); and
• consider how dashboards could affect member outcomes more generally, both in the context of pension scams and where members may make significant financial decisions based on the information they receive from the dashboard.

The Pensions Regulator will be the supervising authority and will be able to issue compliance notices and penalties in relation to dashboard compliance. Penalties would be up to £5,000 for an individual and £50,000 in other cases. Penalties are discretionary, not compulsory, but can apply per instance of a breach of a relevant provision, i.e. potentially per individual member.

Dashboards have the potential to foster member engagement and improve decision-making, but only if full and accurate data is provided to the right recipients. It will be important to ensure that the scheme's matching criteria are sufficiently robust to prevent fraud and pension scams. This needs to be balanced against the need to ensure members receive information on all their pension entitlements when they submit a request.

The Pensions and Lifetime Savings Association (PLSA) has emphasised that schemes need to have certainty where legal financial responsibility will rest should the user take action, or fail to take action:

• in light of their pension not being shown; or
• where the pension actually paid is different from an amount that appeared on a dashboard in the past.

The dashboards regime does not change the ordinary legal liability principles that apply whenever benefit information is provided to a member. However, the greater ease and speed with which members will be able to request data will introduce a marked change in the practical risk of omissions or inaccurate data being provided.

Schemes will also need to consider how dashboards will display and caveat the data they provide. They will have less control over how information is presented than they do when communicating with members directly. They may therefore want to manage this risk through their own communications strategy (see Action 5 (Preparing to engage with members) above).

Schemes will need to keep records of a range of “management information” for at least six years. This includes the number of "find and view" requests received, their matching process and the time taken to respond to each view request. Trustees must provide this information to MaPS, the Pensions Regulator or the FCA on request.

The Pensions Regulator published guidance in June 2022 and updated it most recently  in April 2024 after the DWP issued its connection guidance (see Action 1: Identifying your connection timeframe, above). It has also published a consultation on its dashboards compliance and enforcement policy, which closed on 24 February 2023.

The FCA issued a consultation on the regulatory framework for firms planning to provide a pensions dashboard service (PDS), which closed on 8 May 2024. This consultation provided feedback on the FCA's earlier proposals on the regulatory framework for PDS firms (set out in their December 2022 consultation). It also set out proposals for perimeter guidance on carrying out the new regulated activity of operating a PDS that connects to the MaPS dashboards digital architecture, including outlining the warnings and signposts that PDS firms will need to display and restrictions on marketing. The proposed guidance is intended to help firms plan and prepare for authorisation and determine how to effectively demonstrate they are operating a dashboards service that meets the FCA's standards.

In November 2022, the PDP published revised standards and statutory guidance on connecting to the dashboards ecosystem. These include:

• Code of connection (including security, service and operational standards);
• Technical standards;
• Reporting standards;
• Early connection guidance; and
• Data standards usage guide.

The PDP published Data standards, which were updated most recently in May 2024. The PDP also opened a consultation on design standards, which will set mandatory standards for how information and pension values will be presented, which closed on 16 February 2023. The PDP has also issued notes on its approach to the governance of standards and the connection process and guidance.

In terms of other resources, PASA has prepared materials, including guidance on, connection readiness, getting ready for dashboards, data matching and value data (mentioned above) and has announced plans to issue further guidance through 2024. The PLSA has also produced "Pensions dashboards A to Z", a useful guide for the pensions industry, and a summary checklist of actions schemes should take now.