Framework mapping — ICO Guidance on AI and Data Protection

Framework	ICO "Guidance on AI and data protection" (updated March 2023) and the ICO/Alan Turing Institute "Explaining decisions made with AI"
Mapping version	1.0
Review date	2026-08-21
Next review	2027-02-21, or on ICO publication of updated generative-AI guidance
Status vocabulary	Evidence available · Gap · Not evaluated · Customer

The ICO guidance is regulator guidance, not a certification scheme. This mapping records how AXOS supports a controller's obligations under UK GDPR when AI is in use. It is not a claim that a customer's deployment is compliant.

Accountability and governance

ICO expectation	What AXOS provides	Status	Customer responsibility
DPIA for high-risk AI processing	DPIA support note (DPA) with five platform-level inputs	Evidence available (inputs)	Conduct and own the DPIA
Controller / processor roles documented	Privacy Policy s.1; DPA cl.1 — self-hosted = customer sole controller	Evidence available	Confirm role per deployment
Data protection by design and default	Non-essential cookies off by default; ACL-first retrieval; retention sweep; PII-free logs; AI features per-workspace	Evidence available	Configure for the use case
Record of processing activities (Art 30)	Data inventory in retention.md; sub-processor list	Evidence available	Maintain your ROPA

Lawfulness, fairness, transparency

ICO expectation	What AXOS provides	Status	Customer responsibility
Lawful basis for each processing purpose	Privacy Policy s.3 for ScotiTech-operated services	Evidence available	Identify basis for your use case
Statistical accuracy and fairness testing	Not performed by ScotiTech on customer data	Not evaluated	Test on your data and model
Transparency to individuals about AI use	AI-output labelling; system-prompt disclosure; citations	Evidence available	Privacy notice covering AI use
Explaining AI-assisted decisions	Retrieval provenance (which sources informed an answer) is logged and shown; model-internal reasoning is not	Partial	Choose a model and design with the explanation level your decisions need

Individual rights

ICO expectation	What AXOS provides	Status	Customer responsibility
Right of access, rectification, erasure	DSR export/erase route for ScotiTech-held data; per-workspace data controls in self-hosted	Evidence available	Operate rights handling
Rights related to automated decision-making (Art 22)	Privacy Policy s.8: no solely automated decisions on the website; platform deployments are customer-configured with human review gates available	Evidence available	Apply Art 22 safeguards if you automate decisions
Right to object / restrict	Controller obligation	Customer	—

Security (Art 32)

ICO expectation	What AXOS provides	Status
Appropriate technical measures	TLS 1.3, AES-256, RBAC, security headers, rate limiting, admin-key guard, env validation, PII-free logs	Evidence available
AI-specific risks (adversarial input, model inversion, membership inference)	Retrieval scoped to permitted content mitigates data exposure; model-level attacks are the model provider's domain and the customer's to assess	Partial / Customer
Breach notification	72-hour ICO commitment as controller; 48-hour notice as processor	Evidence available

Data minimisation and retention

ICO expectation	What AXOS provides	Status
Collect only what is necessary	Registration collects business contact and intent fields only; OTP stored as hash	Evidence available
Retention limits enforced	Daily sweep; windows published and unit-tested	Evidence available
Training-data minimisation	Not applicable — no training on customer data (see no-training-statement.md)	Evidence available

Gaps and roadmap

• No ICO-recognised certification scheme currently covers this area; none claimed.
• Fairness / bias evaluation tooling inside AXOS — gap; customers must test externally today.
• Formal "explainability statement" template for customers — planned as part of the technical documentation pack.