02.08AI
AI governance and UK GDPR
AI governance and UK GDPR from Hot Rocket Software, a team of software, website and digital marketing specialists based in the UK, with 19 years in IT. Practical AI governance for UK businesses: AI use policies, DPIAs, supplier checks and the Data (Use and Access) Act 2025 rules on automated decisions.
02.08.0
What is AI governance and UK GDPR?
AI governance is making sure your use of AI is lawful, safe and explainable: knowing which AI tools are in use, what data goes into them, who checks the outputs, and what you tell customers. We help you write an AI use policy, run data protection impact assessments, check suppliers, and design systems with human review built in. We are engineers, not lawyers, and we work alongside your legal adviser where needed.
02.08.1
Who is it for?
- Businesses whose staff already use AI tools without a policy
- Teams deploying AI that touches customer or employee data
- Leaders who need to answer the question 'are we compliant?'
02.08.2
From a small business to a large organisation
The same team takes on a single tool for a small business and long-running work for large companies and the public sector. Here is what each end looks like.
For a small business
A short, plain AI policy for your team: which tools are allowed and what never goes into them.
For large companies and the public sector
AI governance across a large organisation: policy, risk registers, DPIAs, supplier assessment and controls that auditors can follow.
- AI policy and acceptable use
- DPIA and risk assessment
- Supplier and model assessment
- Controls, logging and review
02.08.3
What you get
- 01An inventory of AI tools and data flows in use
- 02An AI acceptable-use policy in plain English
- 03Data protection impact assessments for AI projects
- 04Supplier due-diligence checklist (data location, training use, retention)
- 05Human-review and logging requirements built into the systems we deliver
02.08.4
How we approach it
Discover
Find out what AI is already being used, and on what data.
Assess
Risk-rate each use against UK GDPR and your contracts.
Write
Policy, DPIAs and supplier checks, in plain English.
Embed
Training and technical controls so it actually happens.
Review
Revisit as the law and the tools change.
02.08.5
Questions
What changed with the Data (Use and Access) Act 2025?
Among other things, it rewrote the UK GDPR rules on automated decision-making. Since 5 February 2026 a wider range of lawful bases can support significant automated decisions, but safeguards such as transparency, the right to human intervention and to contest decisions still apply, and special category data remains more restricted. The ICO has been updating its guidance to match.
Do we need a DPIA for AI?
Often, yes. The ICO expects a DPIA for processing likely to result in a high risk to individuals, and many AI uses involving personal data meet that bar. We help you decide and document it either way.
Are you lawyers?
No. We are software engineers who build AI systems to data protection requirements. For legal advice we work alongside your solicitor or data protection officer.
T+99Next step
Talk it through with us
A free 30-minute first chat, with no obligation. Tell us what is getting in the way; we tell you honestly what we would do, roughly what it would take, and whether it is worth doing at all.