Section 42(2)

The controller has an appropriate policy document in place in relation to the sensitive processing if the controller has produced a document which— explains the controller's procedures for securing compliance with the data protection principles (see section 34(1)) in connection with sensitive processing in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, and explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the consent of the data subject or (as the case may be) in reliance on the condition in question, giving an indication of how long such personal data is likely to be retained.

← 1 · All articles · 3 →

Source: legislation.gov.uk · retrieved 2026-09-04