Describe your business, leave with a checklist you can assign

Inventory every decision point in the product that produces a legal or similarly significant effect for a UK individual (credit or risk refusals, CV screening, account bans, pricing and lending, insurance underwriting, content actions) and determine for each whether there is “meaningful human involvement”. For those that are solely automated, implement and be able to evidence four safeguards: give the individual information about the decision, let them make representations, provide human intervention on the controller’s part, and let them contest the decision. The assessment of meaningfulness must take into account the extent to which the decision is reached by profiling.

Evidence: Automated decision inventory (decision point, input features, output, impact tier, reasoning on whether it is solely automated); Human-intervention design note plus sample intervention records (reviewer authority, evidence that decisions can be overturned); Notice text served to individuals and screenshots of the contest/appeal route; Data protection impact assessment and its review record

GDPR Data Protection Impact Assessment (DPIA) — for AI training and inference

A significant decision based entirely or partly on Article 9(1) special category data (health, biometrics used for unique identification, race, religion, sexual orientation, trade union membership) may not be taken solely automatically unless the data subject has given explicit consent, or the decision is necessary for entering into or performing a contract with the controller, or is required or authorised by law, and Article 9(2)(g) applies. Separately, a significant decision may not be taken solely automatically where the processing relies entirely or partly on Article 6(1)(ea) (recognised legitimate interests). Engineering must be able to show that special category data and its proxies are absent from, or stripped out of, model inputs.

Evidence: Feature inventory and screening conclusion for special category data and proxies; Memo on the Article 9(2) condition relied on and its legal basis; Records of explicit consent capture and withdrawal (where consent is relied on); Technical note and test report on input filtering/masking for the model

GDPR Data Protection Impact Assessment (DPIA) — for AI training and inference

Map every data flow out of the UK to the Chinese parent, overseas cloud, model-training environments and third-party labelling vendors, and put an Article 46 safeguard in place for each: the ICO’s International Data Transfer Agreement (IDTA), the UK Addendum to the EU SCCs, or approved binding corporate rules. Then operationalise the technical and organisational measures the clauses promise (access control, encryption, sub-processor approval, government access request handling) and refresh them when vendors or sub-processors change.

Evidence: Data flow map and restricted transfer register (exporter, importer, data categories, purpose, mechanism); Executed IDTA or EU SCCs plus the UK Addendum, including schedules and the technical measures annex; Sub-processor list and onward transfer approval records; Government access request handling and notification procedure

Transfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses

Open tool: Transfer Matrix

Complete a DPIA before training, fine-tuning or deploying an AI system on UK personal data and cover, per the ICO’s AI and data protection guidance: separate lawful bases for training and inference; statistical accuracy and fairness including bias testing; data minimisation and privacy-enhancing technologies; security of the model and training data (model inversion and membership inference); and how individuals exercise their rights. Note that the new Schedule 4 recognised legitimate interests basis cannot support processing used for a solely automated significant decision (Article 22B(4)), so check that when selecting a basis. Transparency must explain the model’s purpose, the categories of data sources and the key logic of decisions.

Evidence: AI system DPIA, with separate lawful basis analysis for training and inference; Evidence of data provenance and licence chain (procurement contracts, crawling policy, public-source documentation); Statistical accuracy and bias test reports; Model card / system description and the user-facing transparency notice

GDPR Data Protection Impact Assessment (DPIA) — for AI training and inference

Under the amended Article 46(1A), signing the IDTA or Addendum is not enough: the exporter must, acting reasonably and proportionately, conclude that the data protection test is met for the transfer or that type of transfer — that protection in the destination is not materially lower than under UK law. The assessment must cover rule of law and human rights, the existence and powers of a data protection authority, government access and surveillance law, and the possibility of onward transfer. For transfers into mainland China it must specifically address government access and cooperation duties under the Cybersecurity Law, Data Security Law and PIPL, and the supplementary measures adopted (encryption, key custody outside the destination, minimisation, refusal of requests lacking legal basis). Keep the conclusion on file and review it periodically.

Evidence: Data protection test / TRA report, tiered by transfer type; Analysis of the destination’s legal environment and external legal opinion, if obtained; List of supplementary technical and organisational measures with effectiveness verification records; Review schedule and the conclusion of the previous review

Transfer Impact Assessment (TIA) — supporting Clause 14 of the EU Standard Contractual Clauses

Open tool: Transfer Matrix

Section 78 limits the right of access to what the controller can provide “based on a reasonable and proportionate search”, so define and document in advance: which systems are searched, with what keywords and time windows, and why particular backups or logs are excluded. Section 76 introduces UK GDPR Article 12A, an “applicable time period” that can be paused while identity is confirmed or the scope of the request is clarified. The hard part for AI companies is personal data in training sets, vector stores, prompt logs and model outputs — set an explainable, reproducible search scope before the first request arrives.

Evidence: DSAR procedure, including the method for scoping searches and a proportionality reasoning template; DSAR log (receipt date, reason and duration of any clock pause, response date, what was provided or withheld); System and data source inventory, recording whether training sets, vector stores and prompt logs are searched and why; Response letter templates and exemption reasoning

Section 70 inserts UK GDPR Article 6(1)(ea) and Schedule 4 “recognised legitimate interests”, which remove the need for a balancing test within that list; section 71 and Schedule 5 list further processing treated as compatible with the original purpose. Re-check the lawful basis recorded for each processing activity, identify what can move to the new basis and what still needs a legitimate interests assessment, and update the privacy notice and ROPA. Note that processing relying on Article 6(1)(ea) cannot be used for a solely automated significant decision.

Evidence: Updated ROPA with a lawful-basis mapping table; Legitimate interests assessments and their review conclusions; Versioned privacy notice with effective dates; Cross-check record against the Article 22B(4) restriction

GDPR Data Protection Impact Assessment (DPIA) — for AI training and inference

From 19 June 2026 a controller must facilitate complaints that processing infringes the UK GDPR or Part 3 of the DPA 2018, by steps such as providing a complaint form that can be completed electronically; acknowledge receipt within 30 days; and without undue delay take appropriate steps to respond — including making enquiries and updating the complainant — and inform them of the outcome. The Secretary of State may by regulations require controllers to report complaint volumes to the Commissioner, so build the counting capability now.

Evidence: Online complaint form and sample submission acknowledgement; Complaints register (acknowledgement date, investigation record, outcome notification date); Internal complaint handling procedure and escalation rules; Monthly/quarterly complaint volume statistics