Your privacy rights

This article outlines how ​the Trustee and RPMI ​use your data, ​as well as your rights under the General Data Protection Regulation (GDPR).


The General Data Protection Regulation (GDPR) takes into account technology changes over the last 20 years and harmonises data protection law across Europe. 

How we use infomation about you

We, the Railways Pension Trustee Company Limited and RPMI Limited (each with its registered address at 7th Floor, Exchange House, 12 Exchange Square, London, EC2A 2NY) will use your personal details in order to deal with and pay any benefits you may be entitled to under the rules of the Railways Pension Scheme, The BT Police Superannuation Fund, The British Railways Superannuation Fund, or any other pension fund administered by RPMI. As part of the service we provide we may share your information with other organisations for the purposes of identifying accurate information as to your whereabouts or for the purpose of paying any benefits that you may be entitled to.

We will handle your data in compliance with all relevant data protection legislation, including in compliance with the General Data Protection Regulation (GDPR).

Each of the Railways Pension Trustee Company Limited and RPMI Limited is a “data controller” in respect of your personal information for the purposes of applicable data protection legislation. If there is a Pensions Committee for your section, it will also comply with the data protection legislation.

Purpose of using information

We process information or data for the reasons/purposes mentioned above. This information may include:

  •  personal details;
  •  family, lifestyle and social circumstances;
  •  financial details;
  •  employment and education details; and/or
  •  goods or services provided.

We may also need to process sensitive classes of information, such as physical or mental health details, in order to administer ill- health retirement payments and applications.

This information may be obtained from your employer, ex-employer, government agencies, service providers or from yourself.

We will only collect and use your personal information where:

  •  there is a legal obligation for us to do so;
  •  it is for our legitimate business interests; or
  •  you have given us your consent to do so.

Our legitimate business interests include fulfilling our role in dealing with, assessing eligibility for and paying any benefits you may be entitled to. We will not use your data for our legitimate business interests if they are overridden by your interests, rights or freedoms.

You do not have to provide the information requested from you, but there may be a delay in the payment of your benefits if that information is not provided.

If we are processing your data on the basis of your consent, you can withdraw your consent at any time by contacting RPMI’s Data Protection Officer (details below). The withdrawal of consent will not affect the processing of personal data carried out before consent was withdrawn.

Who the information may be shared with

From time to time, we may need to share your information with other parties. Where this is necessary, we are required to comply with relevant data protection legislation. The types of third parties we may need to share some of your information with are:

  • claimants, beneficiaries, assignees and payees;
  • pension schemes with which the person whose personal information we are processing has an association;
  • trade and business associates and professional advisers. This includes your current or former employer - for the purposes of operating the Scheme;
  • healthcare, social and welfare organisations;
  • financial organisations and advisers. This includes scheme advisers such as actuaries, auditors and lawyers;
  • central and local government;
  • service providers;
  • ombudsmen and regulatory authorities;
  • suppliers;
  • family, associates or representatives of the person whose personal data we are processing; and/or
  • tracing agencies.

If you qualify for free financial counselling we will give your information to carefully selected organisation(s) with which we have arranged to provide this service. We or they may contact you by mail or telephone. If you do not wish to take advantage of this service, please notify the Data Protection Officer in writing who will forward an acknowledgement to you within 7 days.

Retention of data

One of the key principles of the relevant data protection legislation, including the GDPR, is that the personal data we store and process shall be adequate, relevant and limited to what is necessary for the purpose it was originally collected. Our standard policy is for information or data to be kept for only as long as necessary. It is then disposed of in a managed and secure way. However, as pensions are a long-term saving vehicle, it may be necessary to retain your personal data for the remainder of your life and any dependants’ lives in order to pay you the benefits you are entitled to, along with any dependant’s benefits payable.

Transferring data overseas

Our core systems, data, and administration services are all carried out and stored within the UK. However, TCS an international multinational information technology service, based in India, provides maintenance support. Therefore, on rare occasions it may be necessary to transfer your data overseas to TCS.

Transferring personal data to a country outside the European Economic Area that does not have adequate data protection is prohibited unless the country has been approved by the European Commission as providing an adequate level of data protection or adequate safeguards have been put in place to ensure the security of the data. 

As India is currently not on the European Commission’s list of countries providing adequate data protection, the Railways Pension Trustee Company Limited and RPMI Limited have taken steps to put in place appropriate and suitable safeguards. RPMI and TCS have entered into a data protection contract using standard clauses adopted by the EU Commission (so-called ‘model clauses’). These contain enforceable data subject rights and effective legal remedies for data subjects against TCS. A copy of these are available upon request at the address below.

If, at any time, we propose to use your personal data for any other reason than outlined, we will provide you with further details as to why and for what reason we intend to do so.

If you are completing forms, on behalf of a child, by signing and returning the form(s) you provide your explicit consent, on behalf of the child in whose name the claim is being made, to the use of their information for all or any of the above purposes. In addition, we may hold and use your personal information, which will be dealt with on the same basis as set out above. 

Your rights

You will have a number of rights under the data protection legislation. These include the right to:
  • see the information we hold about you;
  • request personal data to be amended if it is inaccurate or incomplete;
  • request the deletion or removal of personal data where there is no compelling reason for its continued use;
  • block or restrict the processing of your personal data; and
  • object to the processing of your personal data.

There is also a right to receive your personal data (in a structured, commonly used and machine-readable format) and to transfer your data to another service provider or data controller. This right applies where your data is being processed on the basis of your consent or in line with a contract to which you are party. Please note that, for the majority of members, this is not applicable as we rely on our legitimate business interest to collect and process your data rather than individual consent or contracts.

Further information

If you wish to exercise any of your rights or have concerns about the processing of your personal data or wish to raise any issues in relation to data protection, including in relation to the use of it by Railways Pension Trustee Company Limited, RPMI Limited or the Pensions Committee for your Section, please contact the Data Protection  Officer at RPMI:

Data Protection  Officer - Mark Beck,
Stooperdale Offices,
Brinkburn Road,
County Durham DL3 6EH

Tel: 0800 2 343434


If you are unhappy with how your personal information is being handled, you also have the right to make a complaint to the Information Commissioner’s Office, an independent body set up to uphold information rights, which will investigate your complaint.