The General Data Protection Regulation takes effect from 25 May 2018, and will require significant planning and preparation by UK pension schemes. Although many of the basic concepts set out in the GDPR will be familiar, trustees (as data controllers) will need to carry out a wide-ranging review of data protection issues and practices. Standard processes, contracts with administrators and other data processors, and member communications will all need to be updated.