Defined contribution (DC) plans may benefit greatly from fast-paced advancements in technology and enhanced data sharing across service providers. Yet the rising number, frequency, and scope of unauthorized data breaches and associated class-action litigation have plan sponsors understandably concerned. Regardless of how it occurs, a breach of sensitive participant data can be quite damaging to the plan and its fiduciaries and participants, as well as the firm sponsoring the plan. This paper seeks to help plan sponsors understand today’s rapidly changing data risk environment. We discuss how participant accounts are vulnerable to data breaches, highlight updated regulatory guidance, and offer action steps for plan committee consideration, in partnership with the plan’s overall organization, consultant/advisor and counsel as needed.

In early 2025, the project expanded its focus to DC system decision-makers—including plan sponsors, consultants, and advisors. Interviews with 22 employers conducted in early 2025 revealed a gradual shift in mindset—from “we got them to save” toward “now we help them spend wisely.” However, operational complexity, fiduciary risk, and participant inertia remain major challenges. Findings from this interview phase are available below.

Capturing direct input from plan sponsors, this resource surfaces the key opportunities they see in expanding retirement income options as well as the practical and regulatory obstacles standing in the way. It offers an honest look at where the industry stands and what would accelerate progress.

There are multiple key measures of retirement income adequacy and one such focus is on replacement rates as an aspirational benchmark. These are typically around 70% of pre-retirement income, and are often less than 100% due to reduced expenses and tax differences in retirement. You can't rely on a single metric and need more nuanced approaches to evaluating whether participants are truly prepared for retirement income needs.