Demonstration · not a client result
Responsible-AI and data-protection review what the deliverable looks like
The structure of the deliverable for responsible-AI and data-protection review, how it is produced and how you accept it, with a live specimen generated from the matching free tool’s worked example. Synthetic or permitted data only.
What this page isDemonstration
- Practice
- 04 AI governance & assurance
- The deliverable
- 4 sectionsProduced in 5 stages, each with a review point
- Data
- Synthetic or permittedNot a client result
Demonstration of methodSynthetic or permitted data.Not a client result.
The deliverable, section by section.
What you receive, and what each part is for.
Data-flow map
Collection, storage, sharing and deletion for the workflow.
DemonstrationGap register
Operational gaps with the risk and the fix for each.
DemonstrationAI-use notes
Where AI touches personal data and what controls it needs.
DemonstrationRemediation scope
What to fix, in what order, and who should do it.
DemonstrationA live specimen.
Generated from the worked example in Data mapping template: synthetic data, real method. Change the inputs in the tool to see your own.
Demonstration · synthetic data · not a client result
| Category | Type | Purpose | Shared with | Transfer | Kept for | Basis |
|---|---|---|---|---|---|---|
| Pupil records | Personal | Teaching and reporting | Parents, examination body | Stays in Ghana | Until age 25 | Statutory duty |
| Pupil health notes | Special category | Care and safeguarding | School nurse | Stays in Ghana | Not set | Consent |
| Fee payments | Personal | Billing | Payment provider | United States | 7 years | Contract |
| Newsletter list | Personal | Updates to parents | Email platform | EU or UK | Until unsubscribed | Not decided |
Open governance questions
- Gap: How long is “Pupil health notes” kept?Set a retention period and a deletion routine.
- Check: “Pupil health notes” is special-category data.Stricter conditions apply; confirm yours and limit access.
- Check: “Fee payments” leaves Ghana (United States).Confirm the safeguards for cross-border transfer.
- Gap: No processor contract for “Fee payments” with Payment provider.
- Gap: What is the lawful basis for “Newsletter list”?
- Check: “Newsletter list” leaves Ghana (EU or UK).Confirm the safeguards for cross-border transfer.
A preparation map, not a registration certificate or legal opinion. Confirm requirements with the Data Protection Commission and a qualified adviser.
How it is produced, and accepted.
Each stage ends in something you review; acceptance is tested against criteria agreed at the start.
- 01
Inventory
Map the workflow and the data it handles.
Review pointInventory of systems and data in scope, confirmed by you.
- 02
Applicability
Determine which requirements apply to it.
Review pointApplicability findings reviewed before controls are drafted.
- 03
Controls
Assess existing controls and design missing ones.
Review pointControls agreed with the people who will run them.
- 04
Ownership
Assign owners for each control.
Review pointOwners named and accepted in writing.
- 05
Review
Agree the review cadence and evidence.
Review pointReview date set, with what will be checked.
How proof is labelled
- DemonstrationsDemonstrations use synthetic or permitted data.
- Documented experienceDocumented experience is attributed to the organisation that held the work.
- Measured resultsMeasured results are added only once they have been measured; none are shown yet.
What needs to move forward?
Tell us the decision, the challenge or the opportunity. We reply with a scoped approach, a named principal and a fee before any work begins.
No charge to submit an enquiry.