(1) Where regulations 28 and 29 apply, communications providers must establish and maintain internal procedures for responding to requests for access to users' personal data.

(2) Communications providers shall on demand provide the Information Commissioner with information about -

(a) those procedures;

(b) the number of requests received;

(c) the legal justification for the request; and

(d) the communications provider's response.