Retention of data in relation to certification (paras. 7.2.20.-7.2.23.)
7.2.20. Firms and holding companies are required to maintain all information collected in compliance with its obligations under Section 21 of the 2010 Act and the Certification Regulations for the duration during which the individual performs the CF role. This includes the documentation of, and records in relation to, the certification of each individual in a CF role, and the due diligence and the agreements to abide to the standards of fitness and probity.
7.2.21. Firms and holding companies are required to maintain the information collected in compliance with Section 21 of the 2010 Act and the Certification Regulations for a minimum of 6 years after that individual has ceased to perform the CF on behalf of the firm.
7.2.22. The Central Bank may require to see any such records or due diligence either in the context of an investigation of a firm's/holding company's compliance with Section 21 of the 2010 Act, and the Certification Regulations or an investigation in relation to an individual's fitness and probity to perform a CF role.
7.2.23. Firms/holding companies should have regard to their obligations under General Data Protection Regulation [REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)] in holding the information referred to in this Section including ensuring that the information is held securely and in an appropriate manner.