CSOAI
Initializing...
Free forever · No credit card
CSOAI
Initializing...
GDPR + AI Compliance Kit — £999 one-time + £199/mo monitoring (optional)
Generative AI triggers GDPR at every layer: prompts, embeddings, fine-tuning, and outputs. We map lawful basis, DPIA, automated decision-making, and Chapter V transfers to auditor-ready evidence in days.
Why AI changes the GDPR risk profile
Quick Kit
£9one-time
Self-serve lawful-basis checklist and 12-question GDPR + AI scope test.
Get £9 Quick KitGDPR + AI Kit
£999one-time
DPIA template, transfer mapping, DSAR workflows, and one signed conformity attestation.
Buy — £999Pro
£199/month
Continuous control monitoring, quarterly DPIA refresh, and new regulator guidance tracking.
Subscribe — £199/moEnterprise
£1,499/month
Multi-tenant, custom lawful-basis logic, DPO support integrations, and unlimited attestations.
Talk sales — £1,499/moLawful basis & purpose limitation
We map each AI use-case to the correct Article 6 lawful basis, document purpose limitation, and flag re-purposing risks before the ICO does.
DPIA & high-risk processing
Template Data Protection Impact Assessment tailored to generative AI: model training data, prompt retention, inference logs, and automated decision-making.
Cross-border transfer evidence
Chapter V transfer mechanisms (SCCs, IDTA, Binding Corporate Rules) mapped to hosting location, sub-processor list, and model-provider jurisdictions.
Data subject rights automation
Erasure, portability, and access workflows wired to your memory layer. Right-to-explanation annotations for consequential automated decisions.
Yes. If the output contains or is derived from personal data — for example, a summary of a customer record, a recommendation, or a profile — GDPR obligations follow the data. Even synthetic data that can be reverse-engineered to identify an individual may be in scope.
A Data Protection Impact Assessment under GDPR Article 35 evaluates necessity, proportionality, risks to rights and freedoms, and mitigation measures. For AI, it must cover training data provenance, prompt logging, model inference, automated decision-making, and data subject rights.
If personal data leaves the UK/EEA — including to a model provider's US cloud for inference — you need a transfer mechanism such as Standard Contractual Clauses (SCCs), an International Data Transfer Agreement (IDTA), or Binding Corporate Rules. The kit documents the mechanism per data flow.
Yes. The kit includes DSAR workflow templates and, for MEOK-hosted systems, automated retrieval of an individual's data across prompts, memories, and outputs. Erasure and portability are tracked with tamper-evident audit logs.
Most organisations complete the initial gap analysis and DPIA in 5-10 working days. Full workflow integration with existing ticketing and identity systems typically takes 2-4 weeks.
Need a broader AI governance framework?
See the ISO 42001 AIMS kit →MEOK AI Labs · CSOAI LTD · UK Companies House 16939677