Regulation 36 Time limits
A UK competent authority transmitting or making available personal data to a non-UK competent authority or to a UK competent authority referred to in Part 2 of Schedule 4 must when doing so notify the recipient of the time limits established for its retention.
If—
a non-UK competent authority transmits or makes available data to a UK competent authority that is subject to the Data Protection Framework Decision; and
when doing so, indicates a time limit for the retention of that data,
the UK competent authority must take steps on the expiry of that time limit to erase or block the data, or review whether they are still needed.
The obligation in paragraph (2) does not apply if, on the expiry of the time limit, the data are required for a current investigation, the prosecution of a criminal offence or enforcement of a criminal penalty.
If a non-UK competent authority transmits or makes available data to a UK competent authority that is subject to the Data Protection Framework Decision without indicating a time limit for its retention, the UK competent authority shall apply any relevant time limits provided for under any enactment or rule of law.