Schedule 1, Part 2, paragraph 27(3)

If the processing consists of the disclosure of personal data to a body or association described in sub-paragraph (1)(a), or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

← 2 · All articles · 28 →

Source: legislation.gov.uk · retrieved 2026-09-04