Requirement to have an appropriate policy document in placeU.K.
39U.K.The controller has an appropriate policy document in place in relation to the processing of personal data in reliance on a condition described in paragraph 38 if the controller has produced a document which—
(a)explains the controller's procedures for securing compliance with the principles in Article 5 of the [F1UK GDPR] (principles relating to processing of personal data) in connection with the processing of personal data in reliance on the condition in question, and
(b)explains the controller's policies as regards the retention and erasure of personal data processed in reliance on the condition, giving an indication of how long such personal data is likely to be retained.
Textual Amendments
F1Words in Sch. 1 para. 39(a) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 91(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
Commencement Information
I1Sch. 1 para. 39 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(b)