Section 42(3)

Where personal data is processed on the basis that an appropriate policy document is in place, the controller must during the relevant period— retain the appropriate policy document, review and (if appropriate) update it from time to time, and make it available to the Commissioner, on request, without charge.

← 2 · All articles · 4 →

Source: legislation.gov.uk · retrieved 2026-09-04