Opinion 3/2026 on the Proposal for a Regulation amending Regulation (EU) 2019/1238 on a pan-European Personal Pension Product (PEPP)

on the Proposal for a Regulation amending Regulation (EU) 2019/1238 on a pan-European Personal Pension Product (PEPP)

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2019/1238 on a pan-European Personal Pension Product (PEPP).

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 20 November 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2019/1238 on a pan-European Personal Pension Product (PEPP).

The objective of the Proposal is to enhance the functionality and practical effectiveness of the PEPP Regulation by establishing a solid and efficient basis for a personal pension scheme that complements the statutory and occupational pension systems of the Member States. The Proposal also aims to facilitate the development of a more sophisticated PEPP with additional investment and/or risk management options, enabling providers to offer more tailor-made solutions that reflect different risk preferences, market conditions, and national contexts.

The EDPS welcomes the objectives of the Proposal, particularly the goal of giving Union citizens access to a simple, transparent, and portable pension product that they can trust, helping them to save with confidence and to plan for their retirement wherever they live or work in the Union.

Data about PEPP savers and beneficiaries qualifies as personal data within the meaning of EU data protection law and may contain special categories of personal data, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

The Proposal establishes that, where pension tracking systems exist at the national level, PEPP providers and distributors would be required to share information with such pension tracking systems. The EDPS recommends defining clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data. The EDPS recommends empowering the Commission to define, by delegated or implementing act, the categories of personal data that should be shared by PEPP providers and distributors with the entities managing pension tracking systems.

Lastly, the EDPS recommends clarifying whether the offering of tailored (personalised) PEPPs according to the preferences, circumstances and risk profiles of savers would entail any form of profiling of individual PEPP savers.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 20 November 2025, the European Commission adopted the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2019/1238 on a pan- European Personal Pension Product (PEPP) (‘the Proposal’).

2. The Proposal aims to make the PEPP a more attractive and accessible option for savers across the Union considering the different retirement saving preferences and ensuring that there is a clear offer of a simple scheme designed to be transparent, and cost-effective, thereby keeping production and distribution costs low . The Commission considers that the Proposal would empower citizens to save and invest for their future through transparent, competitive, accessible and diverse products that better match their preferences regarding retirement savings, investment risk, and insurance coverage .

3. The objective of the Proposal is to enhance the functionality and practical effectiveness of the PEPP Regulation , by establishing a solid and efficient basis for a personal pension scheme that complements the statutory and occupational pension systems of the Member States. The Proposal also aims to facilitate the development of a more sophisticated PEPP with additional investment and/or risk management options, enabling providers to offer more tailor-made solutions that reflect different risk preferences, market conditions, and national contexts . 4

4. The Proposal is part of a broader pension package that includes the review of Directive (EU) 2016/2341 , on which the EDPS is delivering a separate Opinion.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 20 November 2025, pursuant to Article 42(1) of EUDPR. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR. The EDPS notes the reference to the present consultation in the Preamble of the Proposal. In line with standard practice, the EDPS recommends referring to the present consultation in a recital of the Proposal.

2. General remarks

6. The EDPS welcomes the objectives of the Proposal, particularly the objective of providing Union citizens access to a simple, transparent, and portable pension product that they can trust, helping them to save with confidence and to plan for their retirement wherever they live or work in the Union .

7. Data about PEPP savers and beneficiaries relates to natural persons and, therefore, qualifies as personal data within the meaning of Article 4(4) of Regulation (EU) 2016/679 (‘GDPR’) and Article 3(1) EUDPR.

8. The EDPS notes that contracts concerning PEPPs can cover ‘biometric risks’, i.e., risks linked to death, disability and/or longevity . Therefore, records on PEPPs may contain special categories of personal data within the meaning of Article 9(1) of the GDPR, in particular data concerning health. Therefore, it is important to clearly indicate which categories of personal data will be collected and shared and to ensure that appropriate safeguards are in place.

9. The EDPS notes that the GDPR would apply when personal data are processed in the context of the Proposal. He therefore welcomes the reference to the application of the GDPR in Recital 29 of the Proposal. Likewise, there would be situations where EU bodies covered by the Proposal such as the European Insurance and Occupational Pensions Authority (‘EIOPA’) would be subject to the EUDPR. The EDPS therefore recommends including a reference to the EUDPR in Recital 29 of the Proposal. 5

3. Tailored PEPPs

10. Article 1(17) of the Proposal aims to enable PEPP providers to offer more tailored solutions for savers, providing greater flexibility in the design of ‘tailored’ PEPP options. Recital 18 of the Proposal mentions that such PEPPs would be ‘personalised’ according to the preferences, circumstances and risk profiles of savers.

11. The EDPS recommends clarifying further what is meant by ‘personalising’ PEPPs. In particular, the EDPS, recommends clarifying whether the design of tailored PEPP options would entail any form of profiling, as defined under Article 4(4) GDPR, of individual PEPP savers.

4. Pension tracking systems

12. Article 1(22) of the Proposal provides that “PEPP providers and PEPP distributors shall transmit to pension tracking systems, where pension tracking systems are in place in the Member State where the PEPP is distributed, all information necessary to provide customers with a comprehensive, reliable and up-to-date overview of their entitlements.” Such information (which qualifies as personal data of PEPP savers and beneficiaries) would be transmitted in “standardised and interoperable format enabling pension tracking systems to aggregate data on accumulated value, accrued rights and projected benefits in a coherent and comparable manner.”

13. The EDPS invites the Commission to define “pension tracking systems” in the Proposal, notably by relying on the definition proposed for Article 2(20) of Directive (EU) 2016/97 in Article 2(1) of the Proposal for a Directive of the European Parliament and of the Council amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision . He also recommends proposing clear rules for the functioning of pension tracking systems, including in what concerns the processing of personal data.

14. In particular, the EDPS recommends empowering the Commission to define via a delegated or implementing regulation the format and structure of the information to be transmitted to pension tracking systems, including the categories of personal data to be shared by PEPP providers and distributors. 6

5. Conclusions

15. In light of the above, the EDPS makes the following recommendations: (1) to include a reference to the EUDPR in Recital 29 of the Proposal; (2) to clarify whether the design of tailored PEPP options would entail any form of profiling within the meaning of Article 4(4) GDPR of individual PEPP savers; (3) to define “pension tracking systems” in the Proposal; and (4) to define rules for the functioning of pension tracking systems, including in what concerns the sharing of personal data by PEPP providers and distributors with the entities managing pension tracking systems, and the subsequent processing of the personal data by such entities. Brussels, 9 January 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7