Compliance
SpektraBot processes children's educational data in the UK. We take our legal and ethical responsibilities seriously. This section documents how we comply with data protection law, the ICO's Age Appropriate Design Code, and safeguarding requirements.
Documents
| Document | Purpose | Status |
|---|---|---|
| Data Retention Policy | Defines how long we keep data and why | Approved |
| Children's Code Assessment | Self-assessment against the ICO's 15 AADC standards | In progress |
| Data Protection Impact Assessment | Risk assessment for processing children's data | In progress |
| GDPR Controls | Technical control mapping against GDPR articles | In progress |
| Compliance Checklist | Status tracker for UK certifications, ICO self-assessments, and regulatory requirements | Living document |
| Non-Discrimination Policy | Equality Act 2010 compliance, platform fairness, and inclusive employment commitments | Approved |
Principles
Our compliance approach is built on three principles:
Purpose-driven retention — we keep data for as long as it serves the child's interests, not longer. Different data types serve different purposes and have different retention periods. See the Data Retention Policy.
Privacy by default — high-privacy defaults as required by Children's Code Standard 7. No optional data sharing is enabled without explicit user action.
Transparency — our policies are written in plain language, published on our docs site, and version-controlled in our repository. Nothing is hidden.
Regulatory framework
SpektraBot operates under:
- UK GDPR (UK General Data Protection Regulation)
- Data Protection Act 2018
- Data (Use and Access) Act 2025 (children's data provisions, phased to June 2026)
- ICO Age Appropriate Design Code (Children's Code / AADC)
- Children Act 2004 (safeguarding duty)
- Keeping Children Safe in Education 2026 (KCSIE — references DfE AI safety standards)
- DfE Generative AI Product Safety Standards (legally referenced in KCSIE para 143)
See the Compliance Checklist for our status against each framework, planned certifications, and ICO self-assessment progress.