AI & LLM Data Protection
Rolling out an LLM or AI tool that processes personal data? Find out whether it meets UK GDPR and the EU AI Act before a client, investor, or regulator asks.
Why AI Creates Privacy Risks Standard GDPR Approaches Don't Address
Most organisations treat AI as a standard GDPR exercise. AI raises risks that approach misses.
Training Data
May include personal data never meant for model training — collected without people's knowledge.
Model Outputs
Can reproduce personal training data in outputs, creating disclosure risks standard security misses.
Automated Decisions
Can be discriminatory or hard to explain, especially without meaningful human review routes in place.
Opaque Models
Make it harder to explain processing to people as UK GDPR requires — vague algorithm references fall short.
The Rules That Apply to AI Right Now
AI rules moved in 2026. The UK changed automated decision-making law in February, EU AI Act transparency duties started in August.
Risk Phase-In
In force since August 2024. Transparency duties applying since August 2026. High-risk obligations start December 2027 or August 2028 for AI in regulated products. Can apply to UK businesses selling AI into the EU.
Automated Decisions
Replaced Article 22 on 5 February 2026. Solely automated decisions with significant effects now allowed in more situations — with safeguards: information, human intervention, and a right to contest.
DPIAs
Mandatory for extensive profiling leading to significant decisions, large-scale special category processing, and when innovative technology such as AI combines with another high-risk factor.
AI Regulation
The UK has no AI Act. AI is regulated through UK GDPR and sector regulators: ICO, FCA, and Ofcom. Since 12 May 2026, the ICO has had a statutory duty to prepare a code of practice on AI and automated decision-making.
Specific Risks AI Systems Create Under GDPR
Traditional security checks miss these structural privacy problems in machine learning systems.
Data Ingestion: Training Data & Lawful Basis
Models trained on web-scraped data can contain personal data collected without people's knowledge. Training a model on operational data needs a documented lawful basis and an entry in records of processing.
Model Weights: Outputs & Subject Rights
Models can reproduce personal training data in outputs. Honouring an erasure request when data is encoded in model weights remains a hard technical problem.
Articles 22A–22D: Automated Decision-Making
Credit evaluations, recruitment screening, and insurance pricing can make solely automated decisions with significant effects. Running them without a human review route leaves you exposed.
Explainability: Transparency & Algorithmic Logic
UK GDPR requires meaningful information about the logic behind automated decisions. Vague references to "our algorithms" fall short of ICO transparency expectations.
EU AI Act: High-Risk System Obligations
Systems used in recruitment, credit scoring, and other listed areas face strict obligations from December 2027 — conformity assessment, EU database registration, and documented human oversight.
Vendors & Transfers: Third-Party Model Providers
Many AI vendors process data outside the UK, and some use customer prompts to improve their models unless you opt out. Weak contract terms or a missing transfer mechanism put the risk on you.
What KEWDATA Assesses
Data Inputs & AI-Specific DPIA
We map what personal data enters your AI tools — prompts, uploads, connected systems, knowledge bases — then assess in an AI-specific DPIA covering output risk, bias, and third-party model APIs.
Training Data Provenance
We trace where training and fine-tuning data came from, check for personal data in training sets, document lawful bases, and set retention and deletion rules for data used after deployment.
Vendor Agreements & International Transfers
We review whether each AI vendor acts as your processor or as a separate controller, check contract terms on training use and sub-processors, and confirm a valid transfer mechanism.
Targeted Risk Assessments
Automated Decision-Making Reviews: Identify where Articles 22A–22D apply and design human review routes.
Input & Output Security: Prompt injection, personal data leakage, and output disclosure risks.
EU AI Act Readiness: Risk tier classification, gap mapping, and supporting documentation.
Our Process: Step by Step
A structured, engineering-aligned method for building secure, audit-ready AI workflows.
AI Mapping
Interview engineers and review system architecture to map training sources, APIs, and model pathways.
Risk Classification
Identify risks across training data, output leakage, automated decisions, and EU AI Act boundaries.
Regulatory Mapping
Map the risks against UK GDPR Articles 22A–22D, ICO AI guidance, and EU AI Act obligations.
Mitigation
Design prompt filters, personal data scrubbing, human oversight checks, and governance registers.
Evidence
Hand over the AI-specific DPIA, EU AI Act readiness log, and supporting evidence your team can act on.
Monitoring
Set review triggers for model retraining, API changes, and new regulation — keeping your compliance current.
What the Output Looks Like
You receive written findings your team can act on and evidence you can show a regulator.
| Deliverable Asset | Target Audience | Compliance Value |
|---|---|---|
| AI Data Protection Assessment | Leadership & Legal | Findings for each AI tool, with risk ratings and lawful basis analysis. |
| AI-Specific DPIA | DPO & ICO | Documented risk assessment completed before processing. |
| AI Data Flow Map | Engineering & IT | Where personal data enters, moves, and is stored, including overseas processing. |
| Vendor Review Summary | Procurement & Legal | Contract gaps, training-on-data terms, and transfer coverage for each vendor. |
| EU AI Act Position | Compliance | Our view of each system's risk tier and the obligations that apply. |
| Remediation Roadmap | Product & Engineering | Prioritised actions with owners. Implementation support scoped separately. |
AI Governance Control Dashboard
Track your AI risks and data protection controls in one place.
AI Governance Portal
LIVE- Centralised AI Risk Register: Track severity, mitigation steps, and remaining risks as models change.
- Oversight Evidence: Keep Art. 22A–22D human oversight checks, vendor agreements, and training data reviews in one record.
- Regulatory Milestone Alerts: Get notified ahead of upcoming EU AI Act and UK deadlines.
Tom S.
Medical Practice
"Improved control over sensitive medical data"
"Practical guidance on access controls and data protection. Helped define structured access policies and introduced tokenisation for patient identifiers used in analytics."
Sarah S.
Retail, Enterprise
"Reliable partner for telecom data protection"
"Quickly understood telecom data complexity; helped classify sensitive datasets and apply protection measures for subscriber, usage, and billing data."
Pauliina H.
Entertainment, Enterprise
"Effective support for securing customer data"
"Identified where sensitive data lived and applied tokenization and anonymization strategies in a complex telecom environment."
Jordan R.
Computer Networking
"Practical approach to safeguarding e commerce"
"Helped protect PII, payment data, and order histories with tokenization and anonymization; advised on GDPR compliance for international operations."
Charmaine S.
Int. Trade & Development
"Systematic Approach Enhances Data Security"
"Methodical approach through discovery, planning, and implementation; implemented Microsoft Purview for a scalable compliance framework."
Kateryna H.
IT and Services
"Practical approach to protecting sensitive Data"
"Structured data discovery and classification combining technical analysis with finance data privacy expertise; strong masking and tokenization policies."
Snow D.
Market Research
"Practical expertise for telecom information"
"Introduced tokenization and controlled access strategies for subscriber data while still supporting analytics and reporting."
Laura H.
Hospital & Health Care
"Valuable expertise in healthcare protection"
"Strong expertise in healthcare data security; introduced anonymization techniques for safely using patient data in research and reporting."
The time to address privacy risk is before deployment, not after.
Find out where your AI and machine learning systems stand against UK GDPR and the EU AI Act, and what to fix first.
Book an AI Compliance Review