Additional safeguard: retention of appropriate policy document
This section has no associated Explanatory Notes
40(1)Where personal data is processed in reliance on a condition described in paragraph 38, the controller must during the relevant period—
(a)retain the appropriate policy document,
(b)review and (if appropriate) update it from time to time, and
(c)make it available to the Commissioner, on request, without charge.
(2)“Relevant period”, in relation to the processing of personal data in reliance on a condition described in paragraph 38, means a period which—
(a)begins when the controller starts to carry out processing of personal data in reliance on that condition, and
(b)ends at the end of the period of 6 months beginning when the controller ceases to carry out such processing.