Data Protection Act 2018 (c. 12)

SCHEDULES

SCHEDULE 1 U.K. Special categories of personal data and criminal convictions etc data

PART 4 U.K. Appropriate policy document and additional safeguards

Additional safeguard: record of processing U.K.

41 U.K. A record maintained by the controller, or the controller's representative, under Article 30 of the [F1 UK GDPR] in respect of the processing of personal data in reliance on a condition described in paragraph 38 must include the following information—

(a) which condition is relied on,

(b) how the processing satisfies Article 6 of the [F1 UK GDPR] (lawfulness of processing), and

(c) whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.

Textual Amendments

F1 Words in Sch. 1 para. 41 substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 91(5) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)