Retention and security of personal information
12 Retention and security of personal information
A public sector agency that holds personal information must ensure—
that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and
that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and
that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and
that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
This Act’s bill:Second reading speech
The statute text is free to read above. View subscription options to unlock the case-law research tools for each provision.