Home  Security Services  GDPR & Data Protection

GDPR & Data Protection
— privacy that operates

Data protection you can evidence — mapped data, working DPIAs, AI-aware privacy controls and a response plan you have rehearsed — across UK GDPR, EU GDPR and the AI Act.

Talk to us about this All Security services

GDPR & Data Protection

SECURITY SERVICES

Topics we cover

GDPR complianceUK GDPRData Protection Act 2018Data (Use and Access) ActDPIARecords of processing (ROPA)Data mappingData subject requests (DSAR)International transfersPrivacy by designPrivacy engineeringAI and data protectionAutomated decision-makingPrivacy-enhancing technologies (PETs)ISO 27701Breach notification (72 hours)

Status quo · late 2026

What has changed — and why it matters now

AI made privacy harder

Training data, RAG indexes, agent memory and model outputs are all processing. Regulators expect DPIAs for AI use cases and the AI Act adds overlapping duties.

UK law has shifted

The Data (Use and Access) Act reshaped DSARs, legitimate interests and automated decision-making. UK and EU regimes now need parallel handling.

Privacy became engineering

Classification, retention, minimisation and PETs (differential privacy, synthetic data, confidential computing) are built into pipelines, not written into policies.

How we approach it

Our method for GDPR & Data Protection

01Gap analysisAgainst UK/EU GDPR, ICO guidance and the AI Act; prioritised remediation plan.

02Data mappingROPA, flows, lawful bases, transfers — discovered with Purview / DSPM tooling, not interviews alone.

03DPIAs & AI assessmentsTemplates and facilitation for high-risk processing, including LLM, RAG and agentic use cases.

04OperateDSAR workflow, retention automation, vendor due diligence, breach response plan and tabletop exercises.

05AssureISO 27701 alignment, audits, board reporting.

In depth

AI-specific privacy controls

Purpose limitation for RAG

Index only what the use case needs; row-level security carried into retrieval.

Minimisation in prompts

PII detection and redaction before the model, logging without payloads.

Agent memory & retention

Retention rules for conversation and tool logs; deletion that reaches vector stores.

Automated decisions

Human oversight, explanation and contestability where Article 22 applies.

Transfers

Model-provider region choices, DPAs and transfer assessments for Anthropic, OpenAI, Google and hyperscalers.

What you get

Deliverables

GDPR gap analysisDPIAsData mappingPolicy frameworksBreach response planningDSAR handling

Technology-agnostic

Platforms we work across

We design for the outcome first and choose the platform second — across Microsoft, AWS and Google Cloud, and every major AI provider.

Microsoft PurviewAWS MacieGoogle Cloud DLP / Sensitive Data ProtectionOneTrustBigIDPresidio

More Security services

ISMS & ISO 27001 Penetration Testing SOC & Security Monitoring Security Architecture Identity & Access Management Vulnerability Management DevSecOps & Secure Development GRC Programmes

Ready to talk about GDPR & Data Protection?

One email reaches the architects and engineers who will do the work. We reply within one working day.

info@uspc.co.uk Contact page

GDPR & Data Protection— privacy that operates