Section 40(5)

Once the period referred to in paragraph (3), or if applicable paragraph (4), has expired, the relevant person must delete any personal data obtained for the purposes of these Regulations unless— the relevant person is required to retain records containing personal data— by or under any enactment, or for the purposes of any court proceedings; the data subject has given consent to the retention of that data; or the relevant person has reasonable grounds for believing that records containing the personal data need to be retained for the purpose of legal proceedings.

← 4 · All articles · 6 →

Source: legislation.gov.uk · retrieved 2026-09-04