28. The fifth standard

28.—

1. The fifth standard is that—

(a) personal data processed for any purpose shall not be kept for longer than is necessary for that purpose; and

(b) the disposal of personal data by a data controller shall be in accordance with regulations made under section 74.

2. Subsection (1)(a) is subject to the provisions under this Act with respect to the keeping of records and the provision of access to data.