🗺️ 90-Day Remediation Roadmap

Under UK GDPR Article 13(1)(a), the controller must prominently provide its registered corporate entity name, registered office address, ICO registration number, and official DPO contact details. Remove the email-gate ('email us and we'll send it') and host the full legally binding privacy notice directly at kidguard-mobile.co.uk/privacy. Compliance is achieved when full controller identity is publicly visible and easily accessible without barriers.

Identify and publish specific UK GDPR Article 6 legal bases (such as legitimate interests or performance of contract) across call logging, SMS monitoring, and AI buddy conversations. Establish an Article 9 exemption condition under the Data Protection Act 2018 Schedule 1 (e.g., safeguarding of children) to legitimize processing intercepted special category disclosures like self-harm or abuse. Compliance is complete when a comprehensive lawful basis schedule is published in the privacy notice and documented in the internal Record of Processing Activities (ROPA).

Comply with UK GDPR Articles 44–46 by documenting lawful transfer mechanisms governing personal data exports to US sub-processors (Anthropic, OpenAI, Google, and Zoho). Execute the UK International Data Transfer Addendum to EU SCCs or verify active certifications under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge). Good compliance requires executing transfer mechanisms and publishing specific transfer disclosures within the 'Where your data lives' section.

Satisfy UK GDPR Article 13(2)(b) and (d) by providing detailed instructions on how parents and children can exercise rights of access, rectification, erasure, restriction, and portability. Explicitly communicate the statutory right to lodge a complaint with the UK Information Commissioner's Office (ICO), including direct contact details. Good looks like a standalone 'Your Data Rights' section defining operational response timeframes (one calendar month) and regulatory escalation paths.

Execute a formal DPIA under UK GDPR Article 35 and Children's Code Standard 2 assessing automated keyword surveillance via Anthropic Claude and the OpenAI Learning Buddy. Evaluate high-risk processing, false-positive impacts on children's dignity, and safeguarding escalation paths to Childline/SHOUT against the best interests of the child. Completion requires a fully signed-off DPIA document with residual risk mitigations endorsed by the DPO.

Comply with UK GDPR Article 12(1) and Children's Code Standard 4 (Transparency) by creating tailored, child-facing privacy notices for each supported age band (5–8, 9–12, and 13–17). Use clear language, illustrations, and concise explanations to communicate how messages are monitored, what AI replies involve, and what parents receive. Completion is verified when child users can access these notices directly within their application view prior to initiating interactions.

Address Children's Code Standard 11 (Parental Controls) by designing persistent on-device visual indicators informing the child when SMS, call logs, or keyword monitoring features are active. Prevent covert surveillance by issuing transparent, age-appropriate notifications whenever monitoring rules are modified by parents in the KidGuard Assistant. Compliance is demonstrated when child devices display clear, non-stigmatising status icons reflecting active oversight.

Fulfill Children's Code Standard 4 by embedding contextual, just-in-time notices within the AI Learning Buddy interface before chat sessions begin. Remind the child in age-appropriate terms that the AI is an educational tool rather than a human confidant and that safety alerts will be sent to parents if risks are detected. Good compliance is achieved when these bite-sized prompts are integrated into onboarding and chat initiation flows.

Align platform features with Children's Code Standard 15 (Data Rights) by creating accessible self-service tools for child users to review their conversational data and challenge automated keyword flags. Ensure the UI provides a simple, child-friendly mechanism to request correction or removal of misclassified text without requiring parent-only intervention. Success is marked by an intuitive in-app workflow for children to query records held about them.

Satisfy Children's Code Standard 6 (Policies and Community Standards) by publishing an accessible, age-tailored guide explaining allowed behaviour, safety rules, and moderation policies for the AI Learning Buddy. Detail how safety triggers work for self-harm, grooming, and bullying in terms minors can understand, alongside clear descriptions of helpline integrations (Childline and SHOUT). Good practice is validated when community rules are published in plain English directly on the child app interface.

Embed Children's Code Standard 16 (Governance and Accountability) by appointing a named senior executive specifically responsible for child data protection and Children's Code compliance. Establish formal quarterly privacy audits and document senior-level sign-offs on all algorithmic features and third-party AI integrations. Completion is demonstrated when formal governance charters and review cadences are minuted and adopted.

Satisfy UK GDPR Article 22 principles and Children's Code Standard 2 by creating structured audit pipelines that review false-positive filtering by Anthropic Claude and distress screening by OpenAI. Maintain human-in-the-loop oversight to ensure automated tools do not systematically misclassify harmless interactions or overlook vulnerable minors. Compliance is complete when monthly accuracy, bias, and false-positive audit logs are documented and reviewed by safeguarding leads.

Fulfill accountability duties under UK GDPR Article 24 and Children's Code Standard 16 by implementing tailored data protection training for all engineering, product, and support personnel. Ensure training covers the Age Appropriate Design Code, the best interests of the child, and handling intercepted safeguarding disclosures. Good compliance requires a verified tracking register showing 100% training completion across technical and customer-facing staff.