Schedule 1, Part 4, paragraph 40(1)

Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period— retain the appropriate policy document, review and (if appropriate) update it from time to time, and make it available to the Commissioner, on request, without charge.

← 40 · All articles · 2 →

Source: legislation.gov.uk · retrieved 2026-09-04