Compliance Checklist

How SpektraBot meets UK data protection, safeguarding, and AI safety requirements — and what we're doing next.

Tracking issue: #463

Status Key

Symbol	Meaning
✅	Complete — documented and implemented
🔵	In progress
⚪	Not yet started

---

ICO & UK GDPR

Requirement	Status	Evidence
ICO registration (Data Protection Fee)	🔵	Tier 1 (£52/year) — registration pending
Record of Processing Activities (ROPA)	✅	DPIA Section 2 documents all data categories, processors, and purposes
Data Protection Impact Assessment	✅	DPIA — all technical decisions completed, sign-off pending
Lawful basis documented for each data category	✅	DPIA Section 1.2
Special category data conditions (Art. 9)	✅	Explicit consent for SEND health data — collected at registration with version, timestamp, IP
Privacy notice	✅	Published at /policies/privacy — describes all data categories, retention tiers, and data subject rights
Data subject rights procedures	✅	Right to access, rectification, erasure, and portability implemented. Erasure cascades all associated data.
Data retention policy	✅	Data Retention Policy — 4-tier model validated against ICO Children's Code Standards 7 & 8
Automated retention enforcement	✅	Daily CronJob deletes conversations 90 days after last activity (updatedAt). Soft-deleted memories hard-deleted after 30-day grace.
Data Processing Agreements	✅	Microsoft (automatic via Online Services DPA), Civo (signed with service agreement), Resend (signed separately)
Breach notification procedure	✅	Documented in DPIA M43 — 72-hour ICO notification, affected individual notification, school DPO notification for children's data
ICO Accountability Framework Self-Assessment	⚪	To be completed against ICO's 10-category framework

ICO Children's Code (AADC)

Standard	Status	Evidence
1. Best interests of the child	✅	System purpose is to help parents secure appropriate SEND provision
2. Data protection impact assessment	✅	DPIA
3. Age-appropriate application	✅	Designed for adult users only; no child accounts; no gamification
4. Transparency	✅	Plain-English privacy notice; GDPR consent flow with granular options
5. Detrimental use of data	✅	Data used solely for SEND guidance beneficial to the child
6. Data sharing	✅	Child data not shared with third parties; child PII not sent to LLM
7. Default settings (high privacy)	✅	Privacy-preserving defaults; no optional sharing enabled by default
8. Data minimisation	✅	Tiered retention; only data necessary for SEND guidance collected
9. Geolocation	✅	N/A — no geolocation collected
10. Parental controls	✅	Parents create, edit, and delete child profiles
11. Profiling	✅	Child memories constitute limited profiling — mitigated by source tracking, confidence scoring, parent control
12. Nudge techniques	✅	N/A — no nudge techniques used
13. Connected toys	✅	N/A
14. Online tools	✅	WCAG 2.2 accessibility features
15. Data protection governance	✅	DPIA, retention policy, DPAs, audit logging
Full self-assessment via ICO Risk Tool	⚪	To be completed using ICO's official self-assessment tool

See Children's Code Assessment for detailed analysis of each standard.

DfE Generative AI Product Safety Standards

Referenced in KCSIE 2026 (paragraph 143) — schools are legally required to check AI vendors against these outcomes.

Outcome	Status	How SpektraBot meets it
Clearly states intended purpose and use cases	✅	Welcome wizard, onboarding flow, help drawer, and privacy notice all explain SpektraBot is an AI SEND guidance tool — not a replacement for professional advice
Effectively prevents access to harmful/inappropriate content	✅	Crisis detection system with hardcoded signposting; trauma-informed design; banned language patterns; hallucination checking; self-correcting RAG pipeline
Transparent design prioritising child safety	✅	Child PII not sent to LLM; source citations on all responses; clear AI disclaimers; no child accounts
Robust activity logging	✅	30+ audit log action types; admin access logged with user ID, action type, resource, IP, user agent
Secure against malicious use or harm	✅	JWT auth, RBAC, user data isolation, rate limiting, domain-whitelisted crawler, admin content validation
Accountable in operation	✅	DPIA published; retention policy published; DPAs in place; breach notification procedure documented
Protects cognitive/emotional/social development	✅	Trauma-informed practice (validate emotions, never blame, empower, normalise); distress detection adjusts tone; crisis module routes to human services

Safeguarding

Requirement	Status	Evidence
KCSIE 2026 awareness	✅	DfE AI safety standards compliance documented above
Children Act 2004 s.11 compliance	✅	Safeguarding logs retained indefinitely; crisis detection with emergency service signposting
Designated safeguarding procedures	✅	Crisis detection module; safeguarding log table; distress detection; automated signposting to Samaritans, Childline, 999
Safeguarding record retention	✅	Indefinite — excluded from automated deletion per Data Retention Policy Tier 4

Data (Use and Access) Act 2025

New UK law effective June 2025 with phased implementation through June 2026.

Requirement	Status	Notes
Account for children's age, maturity, and vulnerability	✅	System designed for adults managing children's data; SEND vulnerability explicitly addressed in DPIA
Enhanced Art. 25 protections for children's data	✅	Privacy by design throughout — user isolation, encryption, tiered retention, no child accounts
Explainability of AI decisions	✅	Source citations on all AI responses; clear disclaimers; parents can verify information independently
No tracking beyond educational purpose	✅	No analytics tracking; privacy-preserving feedback (one-way session hash); no third-party trackers

Security & Infrastructure

Control	Status	Evidence
Encryption in transit (TLS)	✅	HTTPS/WSS via Let's Encrypt; SSL redirect enforced at ingress
Encryption at rest	✅	Civo block storage volume-level encryption; S3 backup encryption
User data isolation	✅	Every DB query includes userId filter; WebSocket rooms per user; conversation access verified
Authentication & RBAC	✅	JWT with role-based access (parent, teacher_senco, admin)
Pod security	✅	Non-root (UID 1000), all capabilities dropped, no privilege escalation, read-only root filesystem
Secrets management	✅	Kubernetes secrets; no credentials in values files or source code
Image security	✅	Private GHCR registry with imagePullSecrets; commit-SHA tags enforced (mutable tags blocked)
Network policy	✅	Pod-to-pod rules: ingress→web/api, api→postgres/redis, deny all other
Backup integrity	✅	Rejects files <1MB; verified with pg_restore; 30-day S3 lifecycle
Monitoring & alerting	✅	Prometheus + Grafana; PagerDuty integration; PrometheusRules for DB, backup, API health

Certifications & External Validation

Certification	Status	Cost	Priority
ICO Registration	🔵	£52/year	Required before pilot
Cyber Essentials	⚪	£320+VAT	Recommended — schools look for it
IASME Governance	⚪	£1-3K	Recommended — includes Cyber Essentials
ICO Regulatory Sandbox application	⚪	Free	High — AI + children's data = strong fit
ISO 27001	⚪	£8-20K	Future — if pursuing G-Cloud / large contracts
G-Cloud supplier	⚪	Variable	Future — government procurement marketplace

Self-Assessment Tools (Free)

Tool	Status	Notes
ICO Children's Code Self-Assessment Risk Tool	⚪	Official checklist against all 15 AADC standards
ICO AI and Data Protection Risk Toolkit	⚪	AI-specific assessment for accountability, transparency, fairness, bias
ICO Accountability Framework	⚪	10-category governance assessment with ROPA template
UK Data Ethics Framework	⚪	Cabinet Office tool — scored on 6 dimensions
NCSC Cyber Action Toolkit	⚪	Personalised cyber security action plan
DfE AI Product Safety Standards audit	✅	Documented above

---

Review Schedule

This checklist is reviewed:

1. Quarterly during the pilot phase
2. Before each new school onboarding
3. When legislation changes (Data (Use and Access) Act 2025 phased implementation, KCSIE updates)
4. After any security incident

Last updated: March 2026