Privacy Notice – Member Self-Service (MSS) Portal
Metropolitan Police Service Police Pensions
1. Who we are
For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Controller for personal data processed via the Member Self-Service (MSS) portal is the Metropolitan Police Service (MPS), acting in its capacity as Police Pension Scheme Authority.
Please also see the MPS Privacy Notice, which explains how the MPS processes personal data.
Sopra Steria Limited (SSL) manages and operates the MSS portal on behalf of MPS and acts as a Data Processor, processing personal data strictly in accordance with MPS instructions and contractual obligations.
Personal data is processed in accordance with Data Protection Legislation (DPL), including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy in Electronic Communications Regulation 2003 (PECR 2003). PECR applies only where electronic communications are used in connection with the operation of the MSS portal.
In addition, the Data Use and Access Act (DUAA, 2025) amends, but does not replace the UK GDPR, DPA 2018 AND PECR, 2003.
2. What personal data we collect
When you use the MSS portal, we may process the following categories of personal data. This may include personal data relating to dependants or beneficiaries where relevant to police pension administration:
· Personal identifiers (such as name, date of birth, pension or payroll reference numbers)
· Contact details (including address, email address and telephone number)
· Police service and employment information relevant to pension administration
· Pension scheme records, contributions, benefits and payment details
· Login and security information (such as usernames, IP addresses and login activity)
· Documents you upload to support pension administration (for example, proof of life or identity documentation)
Special category data will only be processed where it is lawful and necessary for police pension administration.
3. How we collect your personal data
Personal data is collected:
· Directly from you when you register for and use the MSS portal
· From MPS systems and pension administrators as part of normal police pension administration
· Automatically through your use of the portal, including system logs used to maintain security and service integrity
Personal data is provided either directly by members or by the Metropolitan Police Service and its appointed pension administrators; no data is obtained from unrelated third-party sources.
4. Why we use your personal data
MPS uses personal data processed via MSS to:
· Provide secure online access to police pension information
· Administer and manage police pension schemes
· Maintain accurate and up-to-date pension records
· Respond to member queries and requests
· Meet statutory and regulatory obligations relating to police pensions
· Protect the security and integrity of MSS and prevent fraud or misuse
Personal data is not used for purposes incompatible with police pension administration
5. Lawful basis for processing
The primary lawful bases relied upon under UK GDPR are:
· Legal obligation – where processing is required to meet police pension and public sector legislative requirements
· Public task – where processing is necessary for the performance of tasks carried out in the public interest
· Legitimate interests - we have a legitimate interest to do so, and it is necessary and balanced against your own interests, rights and freedoms
Where special category data is processed, this is done in accordance with the relevant UK GDPR conditions and associated legislation and is processed lawfully and in limited circumstances.
Personal data processed via MSS is not subject to automated decision-making or profiling as defined under Article 22 of UK GDPR.
6. Who we share your data with
Personal data processed via MSS may be shared with:
· MPS teams responsible for police pension administration
· Pension scheme administrators and trustees (where applicable)
· Sopra Steria Limited and its approved sub-processors supporting the operation of MSS
· Other organisations where disclosure is required by law or regulation
All data sharing is subject to appropriate contractual, technical and organisational safeguards.
Personal data processed via the MSS portal is not routinely transferred outside the United Kingdom.
7. How long we keep your data
Personal data is retained only for as long as necessary to administer police pensions and meet legal and regulatory requirements.
Retention periods are determined by MPS, in line with approved retention schedules. When personal data is no longer required, it will be securely deleted or anonymised in accordance with recognised standards.
8. How we protect your data
Appropriate technical and organisational measures are in place to protect personal data, including:
· Secure authentication and access controls
· Role-based access for authorised staff only
· Encryption and security monitoring
· Staff vetting, training and confidentiality obligations
These measures are designed to protect personal data against unauthorised access, loss or misuse.
9. Your data protection rights
Under UK GDPR, you have rights including the right to:
· Access your personal data
· Request correction of inaccurate or incomplete data
· Request restriction of processing in certain circumstances
· Object to processing where applicable
· Lodge a complaint with the Information Commissioner’s Office (ICO)
Additional rights under UK GDPR, including the right to erasure and data portability, may be restricted where processing is required by law for police pension administration.
Requests to exercise data protection rights in relation to MSS should be made to the Metropolitan Police Service, as Data Controller, using the contact details set out in the MPS Privacy Notice.
10. Contact details
Please refer to the Metropolitan Police Service Privacy Notice for details on how to contact the MPS regarding your personal data
If you have any questions about this privacy notice or how your personal data is used by SSL as the data processor in respect of MSS, please contact: Email: dpo.uk@soprasteria.com
Data Protection Officer, Sopra Steria Limited Address: Three Cherry Trees Lane, Hemel Hempstead HP2 7AH or
You also have the right to contact the Information Commissioner’s Office at www.ico.org.uk
Metropolitan Police Service Privacy Notice
The privacy notice for the Metropolitan Police Service is here.