Schedule 1, Part 4, paragraph 40

Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period— retain the appropriate policy document, review and (if appropriate) update it from time to time, and make it available to the Commissioner, on request, without charge. “Relevant period”, in relation to the processing of personal data in reliance on a condition described in paragraph 38, means a period which— begins when the controller starts to carry out processing of personal data in reliance on that condition, and ends at the end of the period of 6 months beginning when the controller ceases to carry out such processing.

← 39 · All articles · 1 →

Source: legislation.gov.uk · retrieved 2026-09-04