Paragraph 40 I1

(1)

Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period—

(a)

retain the appropriate policy document,

(b)

review and (if appropriate) update it from time to time, and

(c)

make it available to the F1Commission, on request, without charge.

(2)

“Relevant period”, in relation to the processing of personal data in reliance on a condition described in paragraph 38, means a period which—

(a)

begins when the controller starts to carry out processing of personal data in reliance on that condition, and

(b)

ends at the end of the period of 6 months beginning when the controller ceases to carry out such processing.

Annotations

F1: Word in Sch. 1 para. 40(1)(c) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)