Automatic Enrolment Retirement Savings System Act 2024 section 111

Processing of personal data and special categories of personal data

Section 111 provides for the processing of personal data by the Authority and its service providers under the automatic enrolment system, in compliance with GDPR and the Data Protection Act 2018.

• The Authority may process personal data, including special categories of personal data (e.g. health data), where necessary and proportionate for carrying out its functions under the Act, in compliance with GDPR and the Data Protection Act 2018.
• Service providers engaged by the Authority may also process personal data on the same basis, but are prohibited from processing personal data under Part 5 of the Data Protection Act 2018 (which relates to law enforcement processing).
• The Authority is designated as the data controller for all personal data it processes under the Act and must put appropriate data processing contracts in place with each service provider.
• Terms used in this section carry the same meaning as in the GDPR and the Data Protection Act 2018, ensuring consistency with the broader data protection framework.