ChildSafe AI — Compliance Assessment Platform
This DPIA was prepared in accordance with ICO DPIA guidance (2018, updated 2024) and UK GDPR Article 35. It will be reviewed annually or upon any material change to the processing.
ChildSafe AI processes documents submitted by users. Those documents may contain descriptions of data practices affecting children. The ICO's list of processing operations likely to result in high risk (Article 35(3) UK GDPR) is assessed below:
| Criterion | Applicable? | Notes |
|---|---|---|
| Systematic and extensive evaluation / profiling | No | Documents are assessed, not individuals |
| Processing of special category data at scale | Possible | Submitted documents may describe processing of children's data, but ChildSafe AI does not itself process children's data directly |
| Systematic monitoring of publicly accessible areas | No | N/A |
| Novel technology | Yes | AI/LLM used for compliance assessment — novel application |
| Prevents access to service / contract | No | N/A |
| Processes children's data | Indirect | Documents assessed may relate to children's data practices |
Decision: DPIA required — novel AI technology; potential for documents containing personal data; indirect processing of information about children's data environments.
ChildSafe AI is a web-based SaaS compliance assessment tool that enables organisations to upload policy documents (privacy notices, product specifications, terms of service, compliance reports) and receive an AI-generated assessment of compliance with:
The tool generates: a compliance score (0–100), framework-by-framework findings, a DPIA document, a prioritised remediation roadmap, and a compliance certificate (requiring human expert sign-off).
🇬🇧 UK Data Sovereignty Statement: All personal data processed by ChildSafe AI — including user accounts, saved reports, and AI inference — is stored and processed exclusively within the United Kingdom (London, europe-west2). No personal data crosses UK borders at any point in the processing chain. This is enforced at the infrastructure level through Google Cloud region locking, not merely stated as policy.
| Data Element | Source | Legal Basis | Location | Retention |
|---|---|---|---|---|
| Document content submitted by user | User | Legitimate interests (Art. 6(1)(f)) | Memory only — never persisted | Session only — zero server retention |
| Document name | User | Legitimate interests | Browser localStorage | User-controlled |
| IP address / request metadata | Automatic (Netlify) | Legitimate interests | Netlify logs | 30 days (Netlify standard) |
| Anonymised audit log entries | Generated | Legitimate interests | Browser localStorage | Max 50 entries FIFO — localStorage only |
| Email address [if signed in] | User (Google Sign-In) | Contract (Art. 6(1)(b)) | 🇬🇧 Firebase Auth, London UK (europe-west2) | Until account deleted |
| Firebase UID [if signed in] | Generated by Firebase | Contract (Art. 6(1)(b)) | 🇬🇧 Firebase Auth, London UK (europe-west2) | Until account deleted |
| Saved compliance reports [if signed in] | Generated (no document content) | Contract (Art. 6(1)(b)) | 🇬🇧 Firestore, London UK (europe-west2) | Until report or account deleted |
| Documents saved to My Library [if signed in] | User (explicitly saved) | Contract (Art. 6(1)(b)) | 🇬🇧 Firestore, London UK (europe-west2) | Until document or account deleted |
| Processor | Location | Role | Safeguard |
|---|---|---|---|
| Google Cloud / Firebase Authentication | 🇬🇧 London, UK (europe-west2) | User accounts — Google Sign-In, authentication | UK-region enforced at infrastructure level. Google Cloud DPA. No international transfer. |
| Google Cloud / Firestore | 🇬🇧 London, UK (europe-west2) | Cloud database — compliance report persistence | UK-region database. Google Cloud DPA. Data never leaves UK. Firestore security rules restrict access to authenticated user only. |
| Google Gemini API | 🇬🇧 London, UK (europe-west2) | AI inference — compliance analysis of submitted document content (not stored post-analysis) | Document content processed in-session only; not retained after response. Google AI API Terms apply. UK GDPR Data Processing Addendum in place. |
| Netlify Inc. | UK/EU CDN edge | Hosting, serverless function proxy | Transit only — no content storage. Netlify DPA. |
🇬🇧 UK Data Sovereignty — Infrastructure Statement: All three Google Cloud services used by ChildSafe AI (Vertex AI, Firebase Auth, Firestore) are configured to the europe-west2 (London) region. This is enforced at infrastructure level, not policy level. No personal data — including user accounts, compliance reports, or document content — leaves the United Kingdom at any point.
Submitted documents are not themselves special category data. Documents may describe the processing of special category data. ChildSafe AI does not extract, store or further process any special category data found within submitted documents.
| Stakeholder | Consulted | Notes |
|---|---|---|
| DPO / Assessor | David Anderson, CIPP/E, CIPM (Data Protection Officer) | Independent Data Protection Officer |
| ICO Regulatory Sandbox | Pending | Application in progress |
| End users (pilot) | Informal | Pre-launch pilot feedback incorporated |
| Processors | Netlify, Google | Standard vendor DPAs reviewed |
⏳ Peer review pending: A second IAPP-certified privacy professional has been invited to review 5 sample outputs and countersign this DPIA before ICO submission.
| Question | Assessment |
|---|---|
| Could the purpose be achieved without AI processing? | No — manual assessment requires a qualified lawyer at prohibitive cost for SMEs |
| Is document content the minimum needed? | Yes — only first 4,000 characters are transmitted for AI processing; document content submitted for analysis is never stored server-side. Documents the user explicitly saves to My Library are retained in Firestore (London, UK) under the user’s full control |
| Is account/report data retention proportionate? | Yes — compliance reports store scores and findings only (no submitted document content). My Library documents are stored only when the user explicitly saves them; user retains full control with self-service deletion of both reports and documents; all data remains in UK |
| Is the AI model appropriate? | Yes — Google Gemini with structured prompting and temperature=0 for deterministic outputs |
| Is the cloud storage location appropriate? | Yes — Firestore and Firebase Auth both configured to europe-west2 (London, UK); UK data sovereignty is maintained at infrastructure level |
Article 6(1)(f) UK GDPR — Legitimate Interests applies to document analysis processing. Article 6(1)(b) — Contract applies to account creation and report storage (processing is necessary to deliver the account-based service the user has signed up for). Balancing test for legitimate interests: purpose is clear and beneficial; minimum data is used; document content is a business document, not personal correspondence; document content submitted for analysis is never stored server-side. Documents explicitly saved to My Library by the user are stored under Art. 6(1)(b) with the user’s full knowledge and control, restricted by Firestore security rules to the authenticated owner only.
| Risk | Likelihood | Severity | Overall |
|---|---|---|---|
| R1 Document contains personal data inadvertently | Medium | Medium | Medium |
| R2 AI processing via UK London endpoint — no international transfer | Low | Low | Low |
| R3 AI generates incorrect compliance advice | Medium | High | High |
| R4 Netlify access logs expose user IP addresses | Low | Low | Low |
| R5 localStorage accessed on shared device | Low | Medium | Medium |
| R6 Firestore account/report data breach or unauthorised access | Low | Medium | Medium |
| R7 UK data sovereignty compromised via infrastructure misconfiguration | Very Low | High | Low-Medium |
| R8 Documents saved to My Library contain sensitive business data | Low | Medium | Medium |
| Risk | Mitigation | Status |
|---|---|---|
| R1 | Warning advising users not to include personal data in submitted documents; document content submitted for analysis is session-only and never stored server-side; My Library document storage is clearly disclosed in the privacy notice and restricted to the authenticated owner by Firestore security rules | ✅ Implemented |
| R2 | All Google Cloud services (Vertex AI, Firebase Auth, Firestore) locked to europe-west2 (London, UK); UK sovereignty enforced at infrastructure level | ✅ Implemented |
| R3 | "Not legal advice" disclaimer on all outputs; HITL certification requirement; temperature=0; criteria reviewed by CIPP/E CIPM | ✅ Implemented |
| R4 | HTTPS enforced; no additional logging beyond Netlify defaults | ✅ Implemented |
| R5 | Browser localStorage data disclosed in privacy notice; users advised to use private browsing on shared devices | ✅ Documented |
| R6 | Firestore security rules restrict read/write to authenticated owner UID only; Google Cloud DPA in place; reports contain no document content; user can delete at any time | ✅ Implemented |
| R7 | All three Google Cloud services explicitly region-locked to europe-west2 (London) in Firebase project configuration; Google Cloud DPA confirms UK processing; no cross-border transfer mechanism needed or triggered | ✅ Implemented — verified at project level |
| R8 | My Library documents stored in Firestore restricted by security rules to authenticated owner UID only; users can delete documents at any time; privacy notice clearly discloses My Library storage; users advised not to save documents containing personal data | ✅ Implemented |
| Risk | Residual Level | Acceptable? |
|---|---|---|
| R1 | Low | Yes |
| R2 | Low | Yes — UK sovereignty enforced at infrastructure level |
| R3 | Medium | Yes — mitigated by HITL and disclaimers |
| R4 | Low | Yes |
| R5 | Low | Yes |
| R6 | Low | Yes — Firestore rules + user-controlled deletion |
| R7 | Low | Yes — region lock verified at project configuration level |
| R8 | Low | Yes — Firestore rules + user-controlled deletion + clear disclosure |
Overall residual risk: MEDIUM — ACCEPTABLE. Mitigations are proportionate and in place.
This DPIA concludes that ChildSafe AI can proceed with the described processing. Residual risks are acceptable given the mitigations in place. The processing is necessary, proportionate, and serves a legitimate public benefit in supporting compliance with children's data protection law.
ChildSafe AI DPIA v2.1 · August 2026 · Privacomply Ltd · David Anderson, CIPP/E, CIPM (Data Protection Officer) · Review date: August 2027 · Material change: My Library document storage added; Google Gemini API processor reference updated