xmlns:atom="http://www.w3.org/2005/Atom"

SCHEDULES

SCHEDULE 1Special categories of personal data and criminal convictions etc data

PART 4Appropriate policy document and additional safeguards

Requirement to have an appropriate policy document in place

39The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which—

(a)explains the controller’s procedures for securing compliance with the principles in Article 5 of the GDPR (principles relating to processing of personal data) in connection with the processing of personal data in reliance on the condition in question, and

(b)explains the controller’s policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained.