264 R.etention of records 19, (1) Subject to subsections (2) and (3), records of personal information shall not be retained any longer than a prescribed peliod, unless (a) retention of the record is required or authorised by law; (b) the data controller reasonably requires the record for lawful purposes related to its functions or activities; (c) retention of the record is required by a contract between the parties; or (d) the data subject has consented to the retention of the recold. Recolds of personal information may be retained for periods in reexcess of those contemplated in subsection (1) fol histot'ical, statistical or safeguards search purposes and the data controller has established appropriate against the personal data being used for any other puryoses' (2) A data controller which or who has used a record of personal information of a data subject to make a decision about the data subject shall (3) (a)retaintherecor.dfor.suchpeliodasfnaYberequiredor prescribed by law or a code of conduct; or (b) if there is no law or code of conduct prescribing a letention period, retain the record for a period which will affor-d the data subject a reasonable opportunity, taking all considelations lelating to the use of the personal information into account, to request access to the record' A data controller sha1l destroy or delete a record of personal inconfolmation or de-iclentify it as soon as reasonably practicable after the data (1) ot' troller is no longer authorised to retain the lecord in terms of subsection (4) (2). (5) The clestruction ol deletion of a record of personal infolmation in terms of subsection (4) shall be done in a manner that plevents its recon-