Article 32 (documentation)

• 1

  The controller shall ensure the written record of:

  • a.

    the purposes of the investigations referred to in Article 9, paragraph 2;

  • b.

    the provision or transfer of police data under Section 3, with the exception of the provision referred to in Section 17 and Section 24, paragraphs 1 and 2, if this is not compatible with the interest of state security;

  • c.

    the factual or legal reasons underlying a rejection referred to in Article 27, paragraph 1;

  • d.

    a personal data security breach referred to in Article 33a, including the facts about the breach, its consequences and the measures taken to rectify it.

• 2

  When transferring police data to a controller in a third country or to an international organization, referred to in Article 17a, paragraphs 2 (b) and 3, the written record shall include the date and time of transfer, information on the receiving competent authority, the reason for transfer and the transferred data themselves.

• 3

  The controller shall ensure written notification of joint processing of police data to the Autoriteit persoonsgegevens.

• 4

  The police records referred to in the first paragraph shall be kept at least until the date on which the last inspection referred to in Article 33 was carried out.

• 5

  Further rules on the method of recording shall be established by or pursuant to general order in council.