Prescribed requirements, s. 309 (1) (b) of the Act
 10. (1) For the purposes of clause 309 (1) (b) of the Act, this section prescribes requirements in respect of the retention, transfer and disposal of records. (2) In this section, a reference to a record is a reference to a record that is in the service provider’s custody or control and that contains personal information that was collected by the service provider for the purpose of providing a service. (3) In disposing of a record a service provider shall, (a) take reasonable steps to protect the record against theft or loss or unauthorized use or disclosure; (b) take reasonable steps to ensure that the personal information in the record cannot be reconstructed or retrieved; and (c) document the record that has been disposed of in a way that does not document any of the personal information contained in the record. (4) A service provider that ceases to provide the service to which a record relates shall not transfer the record to another service provider for the purpose of allowing that service provider to continue to provide that service unless the service provider that will receive the record has in place a records retention policy under this section that addresses the retention of the type of record being transferred. (5) A service provider shall develop and maintain a records retention policy in accordance with this section and shall comply with that policy. (6) The policy shall set out, (a) each type of record maintained by the service provider and a description of the personal information contained in the record, including the format in which the record is maintained; (b) the classification of each type of record according to the sensitivity of the personal information contained in the record and the manner in which that personal information is normally used or disclosed by the service provider; (c) a time period for which each type of record shall be retained by the service provider; and (d) the method by which the service provider will, (i) dispose of each type of record in a manner consistent with subsection (3), or (ii) if the service provider ceases providing the service to which a record relates, store or transfer the record in a manner consistent with subsection (4). (7) In determining the time periods described in clause (6) (c), a service provider shall consider the following: 1. Whether another service provider also has custody or control of the record or requires the record for the purpose of providing a service. 2. Whether, in the view of the service provider, the record is one to which an individual has a right of access under section 312 of the Act. 3. Whether the record is one which relates to circumstances that are or may be the subject of a possible legal proceeding, other than a legal proceeding described in clause 312 (1) (c) of the Act. 4. Whether the service provider has been informed by the Minister or another service provider that the Minister or service provider may require the information for the purpose set out in paragraph 3 of subsection 283 (1) of the Act or clause 291 (1) (d) of the Act. 5. Any other requirement under the Act or another Act that relates to the amount of time that the record must be retained by the service provider.