NATIONAL PENSION COMMISSION DATA PRIVACY POLICY

A Policy guides the collection, storage, processing, and protection of personal data for pension contributors by licensed operators. It targets Pension Fund Administrators, custodians, PenCom staff, and contributors. This protects privacy and prevents unauthorized use of sensitive financial data.

What Is This Policy?

PenCom's internal policy and regulatory guidance on how Retirement Savings Account data and personal information of pension contributors must be collected, stored, processed, and protected by licensed pension operators.

Who Does It Target?

Licensed Pension Fund Administrators (PFAs) Pension Fund Custodians PenCom data management staff Pension contributors and retirees as data subjects

What Does It Aim to Achieve?

Protect the privacy and personal data of pension contributors, comply with Nigeria's data protection obligations, and prevent unauthorised use or disclosure of sensitive financial data.

Key Features

Data Minimisation: Requires PFAs to collect only the personal data strictly necessary for pension management purposes. Data Security: Mandates technical and organisational security measures to prevent unauthorised access, loss, or breach of contributor data. Data Retention: Specifies minimum and maximum periods for retaining different categories of contributor and retiree data. Breach Notification: Requires PFAs to notify PenCom and affected contributors of any data breach within a prescribed period.

Current Status

Rollout Stage: Active Coverage: All licensed pension operators and PenCom Beneficiaries: Pension contributors and retirees Funding: Operator compliance costs

How to Access

Contributors may request access to their personal data held by their PFA Data subject access requests must be responded to within the statutory period Complaints about data misuse may be filed with PenCom or the NDPC Application method: Direct data access requests to your PFA or PenCom directly.

Important Terms

PFAs may not sell or share contributor data without explicit consent Breach of the data privacy policy may trigger licence consequences Policy aligns with the Nigeria Data Protection Regulation and the Nigeria Data Protection Act 2023

Official Resources

Website: https://www.pencom.gov.ng Contact: National Pension Commission (PenCom)

Legal Framework

The National Pension Commission Data Privacy Policy operates under the Pension Reform Act 2014, the National Pension Commission (PENCOM) Act, and the Data Protection Act 2023. It aligns with the Nigeria Data Protection Regulation (NDPR) 2019 (predecessor to the NDPA 2023), the PENCOM Investment Regulations, and international data privacy standards from the ISO/IEC 27001 Information Security Management System and the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.