Not later than 30 days after the first exportation or transfer of information security items not specified in Schedule 5 to this Order from the United Kingdom under the authority of the Community General Export Authorisation by any person, that person shall (in addition to any notice given under article 28(1)) give to the Secretary of State in relation to those goods or that software or technology written notice of such of the information specified in Schedule 5 to this Order as is in their possession and such other of that information as they can reasonably be expected to obtain within that time.

A person who has given to the Secretary of State written notice of information under paragraph (1) shall, not later than 30 days after any change in that information, give to the Secretary of State written notice of the changed information.

A person who exports or transfers information security items not specified in Annex IV to the dual-use Regulation to a destination within the customs territory shall maintain registers or records in relation to each such exportation or transfer that contain such of the information specified in Schedule 5 to this Order as they can reasonably be expected to obtain and such other of that information as comes into their possession.

The registers or records referred to in paragraph (3) shall be kept for at least three years from the end of the calendar year in which the exportation or transfer took place.