Schedule 1: Special categories of personal data and criminal convictions etc data Part 4 – Appropriate policy document and additional safeguards
The GDPR requires that processing of special categories of data or criminal convictions etc. data should only be carried out if safeguards for the fundamental rights of the data subject are provided for. The safeguards in this Part apply to processing carried out under paragraph 1 of Schedule 1, Part 2 of Schedule 1, and paragraph 35 of Schedule 1 and apply in addition to any express safeguards that are required under any specific processing condition.
	Paragraph 39 defines the safeguard that "the controller has an appropriate policy document in place". The controller must have a document which explains the controller’s procedures for securing compliance with the principles in Article 5 of the GDPR and explains the controller’s policies as regards the retention and erasure of personal data processed in reliance on the condition, with an indication of how long the personal data is likely to be retained.
	Paragraph 40(1) provides that the controller must, during the relevant period, keep the policy document under review and updated and must make it available to the Commissioner on request.
	Paragraph 40(2) defines the "relevant period" for the purposes of paragraph 40(1) as beginning when the controller starts to carry out processing of personal data in reliance on a processing condition in Schedule 1 and ending 6 months beginning when the controller ceases to carry out such processing.
	Paragraph 41 requires that a record maintained by the controller, or the controller’s representative, under Article 30 of the GDPR in respect of processing in reliance on paragraph 1 of Schedule 1, Part 2 of Schedule 1, and paragraph 35 of Schedule 1 must include information on: which condition is relied on; how the processing satisfies Article 6 of the GDPR and whether the personal data is retained and erased in accordance with the appropriate policy document and if not, the reasons for not following those policies.