28.—(1) The fifth standard is that— The fifth
(a) personal data processed for any purpose shall not be kept
° for longer than is necessary for that purpose; and
(b) the disposal of personal data by a data controller shall be in
accordance with regulations made under section 74.
42 (No. } The Data Protection Act, 2020
(2) Subsection (1)(a) is subject to the provisions under this Act with respect to the keeping of records and the provision of access to data. The sixth