Privacy notice

Who we are

We are the Institute and Faculty of Actuaries (IFoA) and our subsidiaries: Continuous Mortality Investigation (CMI) Limited, ICA 98 Limited, and Institute and Faculty Education (IFE) Limited. We are the chartered professional body dedicated to educating, developing and regulating actuaries based both in the United Kingdom and internationally

We are registered as Data Controllers with the Information Commissioners Office (ICO) in the United Kingdom:

The IFoA registration number: Z4899224

The CMI Registration number: ZA121735

Where we are based

We maintain offices in England, Scotland, China, Malaysia, and Singapore.

How you can contact us

For general enquiries, visit the contact us page.

For CMI specific enquiries: info@cmilimited.co.uk

For enquiries about this notice or your information rights: our Data Protection Officer can be contacted by:

Telephone: +44 (0) 131 240 1311

Email: data.protection@actuaries.org.uk

Where we get your personal data

Depending on our reasons for processing your data the sources of this data may be:

you;
your current and previous employer(s);
other actuarial organisations;
educational bodies including schools;
other regulators;
employment agencies;
credit reference agencies;
your previous customers or suppliers;
social media and the Internet;
public records.

If you browse our website we may collect basic information about you via Google Analytics. For more information please see our Cookie Policy

Why we need to process your personal data

Who you are:	Why we process your data:
A member of the IFoA	To facilitate your membership of the IFoA and to assist in the fulfilment of our role as a regulator
A member of another actuarial association undertaking IFoA examinations or applying for mutual recognition	To administer the setting of assessments or in considering applications for mutual recognition status
A prospective member of the IFoA or non-member wishing to sit IFoA examinations that are available to non-members	To process your application to join the IFoA. If you are sitting IFoA assessments independently as a non-member, we need to use your personal data in the course of setting assessments
A non-member attendee or speaker at an IFoA event	To administer your attendance at specific events
A non-member undertaking voluntary work for the IFoA	To support the administrative and communications activity required to manage volunteers
An organisational representative or contact under the IFoA Quality Assurance Scheme (QAS)	In the course of processing your organisation’s application for QAS status and any subsequent administration associated with the QAS. You can read the QAS privacy notice here
An organisational representative or contact under the IFoA Designated Professional Body Scheme (DPB)	In the course of your organisation’s application for DPB status and any subsequent administration associated with DPB
A customer or supplier of goods or services to the IFoA	To communicate with you, place or fulfil orders for goods or services and to send and receive payments
A job applicant	To assist with the administration of the recruitment and selection process
A member of IFoA staff or someone engaged in a paid role	For the day to day administration of your employment or engagement with us
A user of the IFoA website	To analyse site performance and, if you are a registered user, to provide account related functionality
Someone interested in a career as an Actuary (including school children)	To keep you up to date with relevant information about actuarial careers

The lawful basis for processing your personal data

The IFoA only process personal data where there is a lawful basis for doing so. These are:

legal obligation;
contract;
vital interest;
legitimate interest;
public task;
consent.

In line with our role as a regulator we may also process personal data where there is a substantial public interest. This means we may process data without consent in order to protect the public from dishonesty, or in the investigation of malpractice, unlawful acts or improper conduct.

The types of personal data we process

Depending on our reasons for processing your data we may process your:

contact details (i.e. name, previous name(s), current and previous postal addresses, work address, email addresses, phone number(s));
marital status;
education history and exam performance;
employment history;
professional interests;
financial details;
correspondence (to and from us);
professional development;
attendance at events;
national insurance number or equivalent;
passport / identity card number;
health information;
location of birth;
criminal records;
disciplinary records;
image and voice.

From time to time we may collect ‘special category data’ for the purpose of diversity monitoring. This includes data about ethnicity, health, religious beliefs, and sexual orientation. The data is only collected with the consent of the data subject, is subject to additional security measures, and is held only as long as necessary for the intended purpose. Data about diversity is anonymised and reported in aggregate.

How we keep your data secure

Personal data received by the IFoA will be held in accordance with our information security standards. When we share data with third parties we ensure the required technical and organisational controls are in place to keep the data secure. When sharing personal data we use appropriate controls and safeguards. These will be specified in our individual Data Sharing agreements. Examples include only dealing with authorised individuals, adhering to internal policy controls and the use of secure file sharing portals and encryption.

Children's data

From time to time the IFoA processes the personal data of children. This may be to facilitate entry to IFoA sponsored academic competitions, recognise excellence in mathematics at secondary education level or to keep aspiring actuaries up to date with relevant careers information. When we do this the lawful basis is our legitimate interests as the chartered body for actuaries in the United Kingdom. Children's data is kept securely at all times, processed in accordance with the Information Commissioner's Office 'Age Appropriate Design Code ('Children's Code') and available only to those employees that require access to it for their job.

When we share your personal data with third parties

We will share, where appropriate, your personal data with the following organisations:

payment processors and our bank;
organisations assisting with exam logistics such as marking platform providers, scanning services and plagiarism checking;
publishers;
other actuarial organisations;
electoral services providers;
travel and accommodation booking service providers;
credit reference agencies;
employment agencies;
employers;
courier delivery services;
external legal advisors;
third parties who supply the services that support the delivery of our publications, newsletters and electronic library services;
if you're representing us in the UK or overseas and we are funding your travel, we may share personal data about you with travel services, hotels and selected third parties only to facilitate your travel and attendance;
members and lay-members via involvement in our boards, committees, working parties, member interest groups and regional societies;
members and lay-members acting in roles as principle examiners, exam supervisors, other exam personnel, exam counsellors, independent examiners, subject matter experts, and investigating actuaries;
tracing services, in relation to compliance and disciplinary matters;
Competent authorities - i.e. tribunals, courts, police forces, and other regulators such as the Financial Reporting Council (FRC), the Prudential Regulation Authority (PRA), the Pensions Regulator (tPR), or the Financial Conduct Authority (FCA).
Event sponsors (where you have given your consent for this to happen).
Event organisers (where the event is organised jointly with a third party).

Where we share your personal information with other regulators, this is part of our regulatory function, and extends to disclosures relating to disciplinary actions, as well as periodic auditing of our activity by competent authorities. In line with our Constitution, we will not seek your consent for these disclosures.

Illustrative examples of data sharing with third parties

Category of third party recipient	Whose data	Examples of data sharing
Other IFoA members acting on behalf of the IFoA	IFoA members volunteering or applying for volunteer vacancies	To facilitate communication between working parties, committees or boards
Employers of actuaries	IFoA members	For the payment of member fees by their employer The provision of examination pass and new qualifier lists Sharing information relating to an identified regulatory concern about an IFoA member
Other actuarial associations	IFoA members, Members of other actuarial associations, applicants for the CERA mark	Sharing of examination related data for associations using IFoA exam infrastructure Processing Mutual Recognition Agreement applications Sharing information about an active investigation in to an IFoA member that is also a member of another society Sharing information about regulatory responsibilities, framework and enforcement in the public interest for the purpose of membership of the International Actuarial Association and the Actuarial Association of Europe
Universities, colleges and educational providers	Prospective and current student members of the IFoA and other actuarial associations	The validation of information provided in applications to become a student member of the IFoA The validation of applications for exemption from IFoA professional examinations
Regulators and competent authorities	IFoA members	Sharing information relating to an identified regulatory concern about an IFoA member with whom there is a legitimate shared regulatory public interest, for example, with the FRC, the PRA, the FCA and the tPR. Sharing information for the purpose of proportionately discharging any legitimate regulatory oversight responsibility Sharing information about an active investigation in to an IFoA member
Organisations and individuals involved in the assessment and delivery of the examinations of the IFoA	Student members of the IFoA, non-member candidates and members of other actuarial organisations sitting IFoA examinations	Information sent to examination assessment centres to support the delivery of examinations and the accommodation of individual student requirements Data sent to online assessment platforms Exam scripts submitted for plagiarism checks Data sent to examiners in the process of marking assessments Providers of remote invigilation services as part of ensuring the integrity of our assessments
Suppliers of member related services	IFoA members and non-members that have registered their interest in our qualifications or services	Sharing of data with our email messaging service provider to send informational messages Sharing lists of qualified actuaries with electoral services providers for the purpose of voting on Honorary Fellows or changes to bye laws Providing access to our membership system to third party contractors and support services for software development and improvement Basic information about attendees at IFoA events. Please note, where events offer catering this may extend to any critical health related information such as allergies or dietary intolerances. Sharing of information with payment processors Sharing address and telephone contact details with postal services and couriers for the delivery of materials in hard copy Where we partner with an external agency to deliver a member survey we’ll share details back and forth if you choose to make yourself available for follow up questions
Publishers and digital content providers	IFoA members and non-member subscribers	Provision of access to online journals and library resources
Employment agencies	Job applicants	In the course of progressing applications for roles at the IFoA
Members of the public making a complaint about an actuary	IFoA members	Where appropriate: sharing information in the course of the investigation of the complaint

Artificial intelligence (AI)

We use AI in our day-to-day business operations to process information, gain insights and achieve greater efficiency. From time to time we might find it necessary to process personal data using AI for a particular purpose. While we use AI to help us make decisions we never use AI to make those decisions for us on an automated basis. Our AI tool is licensed from Microsoft and the data that flows through it is kept secure at all times within the IFoA enterprise cloud storage.

Social media

We have separate terms and conditions for our social media channels covering issues around data sharing with channel owners, content and behaviour. These are available to review on our website.

When we might transfer your information across borders

As an international body, to facilitate the delivery of regulatory objectives or services related to membership and learning, we regularly transfer personal data across jurisdictions.

We routinely store or process personal data:

within the UK; or
within countries recognised as having an 'adequate' level of protection under UK GDPR; or
within the EEA and countries recognised by the EU as providing an 'adequate' level of protection; or
internationally to countries without an 'adequacy' decision using appropriate technical, organisational and contractual safeguards.

As required under EU GDPR, our representative within the EU is ‘Data Protection Representative Limited’. You can contact them at datarequest@datarep.com, quoting ‘Institute and Faculty of Actuaries’ in the subject line of your email, or by post to DataRep, The Cube, Monahan Road, Cork, T12 H1XY.

How long we retain your personal data

We only retain personal data for as long as we have an operational need or legal requirement to do so.

We securely dispose of personal data when the retention period has expired.

For more information about how long we retain particular data, please contact our Data Protection Officer: data.protection@actuaries.org.uk

When the use of your personal data is based on our legitimate interests

If we send you information based on our legitimate interests as a professional body, such as professional newsletters, updates on our activity, continuous professional development (CPD) opportunities and notices of events, you are able to opt out of receiving this at any time.

By Royal Charter, we are obliged to act in the public interest. Pursuant to our role as a regulator and the objects of our Charter, you cannot opt-out of receiving certain types of regulatory and governance-related information.

Your rights as a data subject

You have the right to:

obtain a copy of any personal data we hold that is about you and not subject to any exemption in data protection law, including footage recorded on Closed Circuit Television (CCTV) systems where the IFoA is the Data Controller;
correct any information we hold about you that is inaccurate or out of date;
ensure we dispose of any personal data we hold about you (once all legal and regulatory record keeping requirements have expired);
restrict the processing of your personal data;
object to us processing your personal data;
erase your personal data, where we no longer have a lawful basis or valid operational reason for holding it;
request we send all or some of the personal data we hold about you to another organisation;
make a complaint about how the IFoA has used your personal data, a data breach incident affecting you, or a concern about how your subject rights request has been responded to. For more information, see: data protection complaints.

In addition, where the lawful basis for processing your data is consent, you may withdraw this at any time by contacting the Data Protection Officer.

If you wish to exercise any of your rights, please contact the Data Protection Officer with your request: data.protection@actuaries.org.uk

If you’re unhappy with how we have used your personal data

In the first instance, please contact our Data Protection Officer so that we can deal with your enquiry. If you are unhappy with how we deal with your concerns you have the right to make a complaint to a Supervisory Authority about how we process your personal data.

In the United Kingdom the Supervisory Authority is the Information Commissioner’s Office