A temporary committee or advisory board set up by royal or ministerial decision or regulation may process personal data if the instituting instrument states the public-interest task and purpose, the controller and the maximum retention period (47a(1)); it may set a use of statutory ID numbers with safeguards (47a(2)); special category and criminal data may be processed only where necessary for a weighty public-interest task stated in the instrument, asking explicit consent is impossible or disproportionate, and specific safeguards are set in it (47a(3)); a committee that processed such data reports before its dissolution on how it processed them (47a(4)); art. 30(4) confidentiality applies to health data (47a(5)); and the instrument is notified to both Houses of Parliament (47a(6)). In force from 1 September 2026.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.