UK Data Protection Act 2018 s.39: Section 39 The fifth data protection principle: retention and periodic review

Data processed for a law enforcement purpose must be kept no longer than necessary for that purpose, and appropriate time limits must be set for periodically reviewing whether continued storage is needed.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part 3: Law enforcement processing – UK Data Protection Act 2018

s.35 Section 35 The first data protection principle: lawful and fair processing and sensitive processing
s.36 Section 36 The second data protection principle: purpose limitation
s.37 Section 37 The third data protection principle: adequate, relevant and not excessive
s.38 Section 38 The fourth data protection principle: accuracy and distinguishing data
s.40 Section 40 The sixth data protection principle: security
s.40A Section 40A Conditions for consent to law enforcement processing
s.41 Section 41 Safeguards for archiving, research and statistical law enforcement processing
s.42 Section 42 Appropriate policy document for sensitive processing

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All UK Data Protection Act 2018 controls