UK GDPR

United Kingdom privacy law follows the European model and then adds its own guidance and amendments. A team that processes personal data there answers to one regulator with published views on AI. This starter provides runtime controls for that traffic and leaves the paperwork with you.

The regulator has published detailed expectations for AI and personal data. Those expectations, rather than a generic checklist, are the practical reference for this configuration. Read them together with the transfer rules that still apply.

A request without a value in the named consent header is refused, whatever it asks for. The listed data categories travel with the decision as a record and do not decide when the check runs. Token validity is not tested here, so the meaning behind a consent value stays with the system that issued it.

National identifier numbers and bank account numbers are masked. Prompts that reach for genetic, biometric or health data are refused, which keeps a special category out of a general assistant path.

Oversight here is total rather than selective. A person receives each response as an escalation, and the caller gets no text from the model. Rights requests, transfers to another country and automated decisions are the cases that make the staffing worth it. Answers must reach 0.80 for combined quality, relevance and accuracy. The starter gives your assessment a defined traffic path to describe.

Transparency notices, lawful basis records and reporting to the regulator inside the statutory window remain your work. Adequacy and transfer risk assessments also stay outside. The European controller and processor starters cover the same ground for entities under the European regulation.