| ID / Theme | Risk to Data Subjects | Pre-Risk | Mitigations | Residual |
|---|---|---|---|---|
| R1 Consent & Lawful Basis |
Absence of documented lawful bases under UK GDPR Article 6 for processing children's call logs, SMS metadata, and AI chat interactions, as well as lack of an Article 9 condition for processing special category health or safeguarding disclosures intercepted during keyword surveillance. Affects: Children (aged 5–17) and their parents · Art. 6, Art. 9, CC Std. 1 |
HIGH |
1. Formulate and document explicit Article 6 legal bases (e.g. legitimate interests with completed LIA or consent) for all processing workflows. 2. Establish an Article 9(2)(g) substantial public interest gateway alongside an appropriate policy document under DPA 2018 Schedule 1 for safeguarding disclosures. 3. Update the published privacy policy to clearly enumerate lawful bases. Owner: Data Protection Officer |
LOW |
| R2 Transparency & Child Notices |
Complete omission of child-facing privacy notices and layered transparency explanations, preventing child users from understanding how their communications, keyword flags, and AI buddy conversations are processed and shared with parents. Affects: Children using mobile app & AI Buddy · Art. 12(1), Art. 13, CC Std. 4 |
HIGH |
1. Develop age-tailored, multi-modal transparency notices specifically designed for the 5–8, 9–12, and 13–17 age cohorts. 2. Publish full statutory privacy policy openly on the website instead of gating behind an email request. 3. Integrate contextual just-in-time notices prior to message submission to AI endpoints. Owner: Product Manager |
LOW |
| R3 Parental Controls & Surveillance |
Deployment of parental monitoring over SMS, call logs, app activity, and notifications without persistent or periodic indicators visible to the child, risking covert surveillance and infringement of privacy expectations. Affects: Monitored children (aged 5–17) · Art. 5(1)(a), CC Std. 11, CC Std. 1 |
HIGH |
1. Implement clear, persistent visual status indicators and periodic on-device notifications informing the child whenever monitoring switches are active. 2. Provide child-accessible guidance explaining what information parents can view. 3. Incorporate joint parent-child onboarding workflows promoting open discussion. Owner: Head of Product UX |
MEDIUM |
| R4 International Transfers |
Transmission of children's messages, device telemetry, and error logs to US-based sub-processors (Anthropic, OpenAI, Google, Zoho) without documented Chapter V transfer safeguards, exposing personal data to extraterritorial access risks. Affects: Children and parent account holders · Art. 44, Art. 46, CC Std. 9 |
HIGH |
1. Execute the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs with Anthropic, OpenAI, Google LLC, and Zoho. 2. Verify sub-processor certifications under the UK Extension to the EU-US Data Privacy Framework. 3. Document transfer risk assessments (TRAs). Owner: Legal Counsel |
LOW |
| R5 Automated AI Triage |
Automated scanning of message snippets and conversation content by third-party LLMs (Anthropic Claude and OpenAI) for keyword false-positive triage without documented human-in-the-loop validation, risking misclassification. Affects: Children interacting with AI · Art. 22, Art. 35, CC Std. 12, CC Std. 2 |
HIGH |
1. Establish formal human-in-the-loop review procedures for critical safeguarding flags before triggering external emergency escalations. 2. Conduct periodic algorithmic bias, accuracy, and hallucination audits across age brackets. 3. Document fail-safe fallback escalation workflows. Owner: Chief Technology Officer |
MEDIUM |
| R6 Data Subject Rights |
Limitation of data subject rights to a parent in-app delete button and unspecific email contact, completely omitting statutory child rights mechanisms for access, rectification, restriction, objection, or complaints to the ICO. Affects: Children (aged 5–17) and parents · Art. 12(2), Art. 15–17, CC Std. 15 |
HIGH |
1. Implement dedicated, child-accessible online self-service tools enabling children to request access, correction, or deletion. 2. Formulate formal standard operating procedures for fulfilling SARs within statutory one-month timeframes. 3. Incorporate prominent notice of the right to lodge a complaint with the UK ICO. Owner: Data Protection Officer |
LOW |
| R7 Governance & Accountability |
Omission of corporate identity, registered office address, designated DPO contact, and ICO registration number in public documentation, coupled with lack of documented senior oversight and staff training under the Children's Code. Affects: All platform users · Art. 13(1)(a), Art. 24, CC Std. 16 |
HIGH |
1. Update privacy documentation to display registered legal company name, UK company number, registered address, and ICO registration number. 2. Designate and publish direct contact coordinates for the DPO. 3. Appoint a named C-level executive accountable for Children's Code compliance and institute mandatory safeguarding data training. Owner: Chief Executive Officer |
LOW |
This formal sign-off records the independent evaluation of the Data Protection Officer under Article 35 UK GDPR. The DPO has independently scrutinized the risk register (risks R1 through R7) and concludes that processing is provisionally permissible subject to full implementation of the enumerated mitigations. Human-in-the-loop sign-off on baseline compliance findings remains a separate governance prerequisite distinct from operational execution.