PDCOB 16 Record keeping

In order to deal with requests for information from the FCA, as well as queries and complaints from customers, firms must keep sufficient evidence and must make and maintain adequate records of how they have complied with the requirements in PDCOB, including evidence of the specific requirements set out in PDCOB 16.2 to PDCOB 16.12.

In complying with the record-keeping rules in this chapter, a firm must not retain the personal data of customers, save as necessary in order to show compliance with the rules – for example, where the record is of correspondence with an individual arising out of a complaint or enquiry.

A firm must retain each record referred to in this sourcebook for at least 6 years.

A firm must make and keep a record of the information customers were presented with at each stage of the pensions dashboard platform and how the information was presented.

Each time there is a material change to the information described in PDCOB 16.2.1R, the firm must keep a record of that updated information and the dates when each version could be accessed by a customer.

A material change is anything that could have an impact on the way a customer may understand the services offered on the pensions dashboard platform, or the way in which a customer is able to use the services, which includes (but is not limited to):

1. (1)

   adding or removing advertising or changing its method of marketing; and

2. (2)

   adding or removing functionality.

A firm must make and keep a record of:

1. (1)

   the number of customers using their pensions dashboard platform;

2. (2)

   the number of customers using their post-view services;

3. (3)

   the number of customers using each of their post-view services;

4. (4)

   the total number of times their post-view services are used;

5. (5)

   the total number of times each of their post-view services are used; and

6. (6)

   in relation to data export:

   1. (a)

      the number of customers deciding to export their data in accordance with PDCOB 11;

   2. (b)

      the number of customers using data export to the firm; and

   3. (c)

      the total number of times that data export has been used.

A firm must make and keep a record of each version of the warning and signposting information provided to customers to comply with PDCOB 5 and the dates that each version was available to a customer.

1. (1)

   A firm must make and keep a record of the advertisements which it places on the pensions dashboard platform, and how those advertisements are placed, including the size, prominence and positioning of the advertisements.

2. (2)

   A firm must make and keep a record of the steps it has taken to comply with PDCOB 6.3.4R.

3. (3)

   A firm must make and keep a record of the remuneration it receives for placing advertisements.

4. (4)

   A firm must make and keep a record of the checks which it has conducted to comply with PDCOB 6.3.3R.

A firm must make and keep a record of the text and presentation of consent options:

1. (1)

   for cookies or similar tracking technologies; and

2. (2)

   for direct marketing purposes.

A firm must make and maintain a record of:

1. (1)

   all versions or iterations of the choice architecture, including the language and format used and the dates each version or iteration was made available to customers;

2. (2)

   how many customers select each of the choices presented to them by the firm; and

3. (3)

   each version of the exit communications presented to customers.

A firm must make and keep a record of any third-party dashboard arrangement into which it enters, including the contractual terms of agreements entered into, and of any changes to such arrangements.

A firm must make and keep a record of:

1. (1)

   the information presented to the customer prior to their data export election;

2. (2)

   where data export to the customer is used, the warnings and messages displayed to customers in accordance with PDCOB 11.4.1R, PDCOB 11.4.2R and PDCOB 11.4.6R;

3. (3)

   where data export to the firm is used, the warnings and messages displayed to customers in accordance with PDCOB 11.5.1R.

4. (4)

   the text and presentation of consent options for data export storage in accordance with PDCOB 11.6.2R by a firm; and

5. (5)

   the consent of the customer.

Where a firm completes, or updates, a data protection impact assessment in relation to its pensions dashboard platform, it must keep a record of that assessment.

Where a firm decides not to complete a data protection impact assessment in relation to its pensions dashboard platform, it must make a record of its reasons for not completing the assessment and retain that record.

A firm must keep a record of:

1. (1)

   the information which it provides to customers to comply with PDCOB 12.5.1R;

2. (2)

   the post-view services offered and the dates when they were available;

3. (3)

   the purpose of the post-view services offered; and

4. (4)

   details of changes to any post-view services included where post-view services are added or removed.

A firm must make an adequate record of the user testing it has conducted to comply with PDCOB 12.3.1R(2), including a record of what, if anything, was changed as a result of the testing.

A firm must make a written record of the assessments required under PDCOB 13.8.4R. In particular, it must make a written record of:

1. (1)

   the major sources of risk identified in accordance with PDCOB 13.8.4R; and

2. (2)

   how it intends to deal with those risks.

A firm must retain the records of its assessments referred to in PDCOB 16.12.1R for at least 3 years.