SCHEDULES

SCHEDULE 1Special categories of personal data and criminal convictions etc data

PART 4Appropriate policy document and additional safeguards

Additional safeguard: record of processing

41

A record maintained by the controller, or the controller's representative, under Article 30 of the F1UK GDPR in respect of the processing of personal data in reliance on a condition described in paragraph 38 must include the following information—

a

which condition is relied on,

b

how the processing satisfies Article 6 of the F1UK GDPR (lawfulness of processing), and

c

whether the personal data is retained and erased in accordance with the policies described in paragraph 39(b) and, if it is not, the reasons for not following those policies.