Regulation 37 Logging and documentation

Any transmission of personal data by a UK competent authority must be logged or documented by that authority for the purposes of verifying the lawfulness of the processing and self-monitoring, and ensuring proper data integrity and security.

A log or documentation prepared under paragraph (1) must be sent on request to the Commissioner, who may use the information only for the control of data protection and for ensuring proper data processing as well as data integrity and security.