Subject to paragraphs 2 to 6, a person holds and vacates the office of Data Guardian in accordance with the terms of his or her appointment.

The period for which a person is appointed as the Data Guardian must not exceed three years.

A person who has held office as the Data Guardian may be re-appointed once only.

The Data Guardian may at any time resign the office by giving notice in writing to the Secretary of State.

The Secretary of State may remove the Data Guardian from office if satisfied that he or she is unable, unwilling or unfit to perform the functions of the Data Guardian.

Service as the Data Guardian is not service in the civil service of the State.