Section 28: Duty to destroy personal data
repealed (no longer in force). juris shows the text as it was consolidated; it does not confirm that this is the law in force today. The records juris holds show this law as repealed.
28. Duty to destroy personal data
(1) Where the purpose for keeping personal data has lapsed, the data
controller shall—
(a) destroy such data as soon as reasonably practicable; and
(b) notify any data processor holding such data.
(2) Any data processor who receives a notification under subsection (1) (b) shall, as soon as reasonably practicable, destroy the data specified by the data controller.
(S. 28 came into operation on 16 February 2009.)