(1) A data reporting service provider must maintain records in retrievable and legible form of information that could be relevant to demonstrating its compliance or non-compliance with any requirement imposed by or under these Regulations applicable to it.
(2) A data reporting service provider must retain the records for no less than five years from the date on which the records were created.