{
  "url": "https://openlegislation.uk/data-protection-act-2018/schedule-1/paragraph-40",
  "json_url": "https://openlegislation.uk/data-protection-act-2018/schedule-1/paragraph-40.json",
  "legislation": "ukpga/2018/12",
  "legislation_title": "Data Protection Act 2018",
  "legislation_url": "https://openlegislation.uk/data-protection-act-2018",
  "path": "schedule/1/paragraph/40",
  "kind": "paragraph",
  "number": "40",
  "heading": null,
  "text": "(1) Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period—\n(a) retain the appropriate policy document,\n(b) review and (if appropriate) update it from time to time, and\n(c) make it available to the Commission, on request, without charge.\n(2) “Relevant period”, in relation to the processing of personal data in reliance on a condition described in paragraph 38, means a period which—\n(a) begins when the controller starts to carry out processing of personal data in reliance on that condition, and\n(b) ends at the end of the period of 6 months beginning when the controller ceases to carry out such processing.",
  "extent": null,
  "status": null,
  "version": "current",
  "annotations": [
    {
      "type": "F",
      "label": "F1",
      "text": "Word in Sch. 1 para. 40(1)(c) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)"
    },
    {
      "type": "I",
      "label": "I1",
      "text": "Sch. 1 para. 40 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)"
    }
  ],
  "outstanding_effects": [],
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/paragraph/40",
    "retrieved_at": "2026-10-29T09:04:55.804064+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}