reference the specific part, section, point or paragraph of the relevant supporting documents, provided as evidence in response to the questions.

Under data protection law, potentially identifiable or pseudonymised data should be retained for only a limited time. Once it is no longer needed, it should be fully anonymised or securely destroyed. This is known as the principle of storage limitation.

6.2.01 Please outline the policy and procedures in place governing the retention of information, data and / or records relating to this proposal. 6.2.02 Please state for how long you intend to retain or archive the identifiable, pseudonymised or potentially identifiable individual-level data in your proposal, including the time-period as an archive or back up copy. This is after all active processing has finished. 6.2.03 Please provide details of which organisation and where the data will be held for the specified retention period. If this is in different locations provide details for all. 6.2.04 Please provide reason(s) as to why the data should be held for this length of time relevant to your organisation. Provide evidence of any stipulations by appending documents or providing the URL to the relevant document. 6.2.05 Please provide details of how the data and output files will be disposed of at the end of the period specified above. You may refer to any relevant disposal or destruction policies used by your organisation. Please reference the relevant section from the policy or include a URL and indicate which section is relevant. 6.2.06 Please confirm what evidence will be obtained following that destruction, if appropriate. This may include certificates of IT hardware destruction or completion of a data destruction certificate.

#### 6.3 Review

This section describes how the policies and procedures, and the controls described within them, described in sections 5.1-5.3 will be operated effectively over time, during both routine and adverse events.

6.3.01 Please provide details on the checks to monitor and audit the mechanisms for the safe guarding of the data. You can reference the relevant parts of policies and procedures listed in sections 5.1-5.3 and 6.1-6.2 above (e.g. dates of policy review or review intervals, statements about accountability for compliance, or details of regular testing and audit of systems or environments). 6.3.02 Please provide details of any aspect of the provision of physical or technical security of data, described in your answers to sections 5.1-5.3, where the resource implications of provision remain unresolved. This might include such examples as encryption of devices which you intend to have in place, but which is not yet fulfilled, IT training which you intend to complete but which is not yet undertaken, secure email accounts you propose to use which have not yet been created, etc. You should provide assurances as to how you intend to resolve these issues. 6.3.03 Please provide details of how you will report any breaches if inappropriate access to the data occurs. Details can be summarised from any security documents that may be relevant. Please ensure that this includes details of how you will notify the data controllers.