UK GDPR by design
Data protection is part of the design, not an afterthought. We only process what the job needs.
Security and data
Your data stays yours.
How we protect personal data and business information when we build and run AI and software for you.
- UK GDPR by design
- UK or EU hosting
- No training on your data
In short
Devsinn designs AI and software to UK GDPR and the Data Protection Act 2018. We sign a data processing agreement, host in the UK or EU where you need it, never use your data to train AI models by default, give access only to the people who need it, and have a written incident response process.
Last updated
Data processing agreement
Where we handle personal data for you, we sign a DPA that sets out exactly what we do with it.
UK or EU hosting
We can keep data and AI processing in UK or EU regions when your policies require it.
No training on your data
Your data is not used to train AI models by default. We choose providers and settings that allow this.
Least-privilege access
Named people, the minimum access they need, removed when the work ends.
Written incident response
If something goes wrong, you hear from us quickly with facts, actions and next steps.
Is AI automation UK GDPR compliant?
It can be, when it is designed properly. UK GDPR does not ban AI. It requires a lawful basis, transparency, data minimisation, security and human oversight where decisions affect people. We build those controls in, document what data goes where, and help you update privacy notices and DPIAs where needed.
The Information Commissioner's Office publishes detailed guidance on AI and data protection. We follow it when we design systems that process personal data.
- A record of which data each AI component uses and why
- Data minimisation: personal data removed or masked where the task does not need it
- Human review for decisions that significantly affect people
- Support with Data Protection Impact Assessments (DPIAs) for higher-risk processing
Where is my data stored and processed?
Wherever your policies require. By default we use reputable cloud and AI providers with UK or EU regions, and we tell you the region for each service before we start. Where a provider processes data outside the UK, we rely on recognised safeguards such as UK adequacy regulations or the International Data Transfer Agreement.
| Option | When to use it |
|---|---|
| UK region | Public sector, healthcare and clients with UK-only data policies |
| EU region | Clients happy with EU hosting under UK adequacy |
| Your own cloud tenant | When data must never leave your account; we work inside it |
Do you use our data to train AI models?
No, not by default. We configure AI services so your prompts and documents are not used to train the provider's models, using business or API terms that allow this. If a project would benefit from fine-tuning on your data, we explain the trade-off and only proceed with your written agreement.
How do you keep AI systems safe and reliable?
We treat AI output as something to check, not something to trust blindly. Systems get clear limits on what they can do, guardrails against misuse, logging so you can see what happened, testing against real examples before launch, and a human in the loop wherever an error would be costly.
- Defined scope: the AI can only reach the tools and data it needs
- Prompt-injection and data-leak testing before launch
- Logs and monitoring so issues are spotted early
- A fallback to a person when the AI is unsure
Who can access our systems and data?
Only named members of the team working on your project, with the minimum access they need. We use multi-factor authentication, separate accounts per person, and we remove access when the work ends. You can ask for an access list at any time.
What happens if there is a security incident?
We follow a written incident response process: contain the issue, assess what data was affected, tell you promptly with the facts, and help you meet your own duties, including reporting to the ICO within 72 hours where a personal data breach requires it. Afterwards we share what we changed.
Cyber attacks are common: the UK Government's Cyber Security Breaches Survey 2025/2026 found that 43% of businesses identified a breach or attack in the previous 12 months, with phishing the most common type at 38%.
Company and compliance details
- Registered name
- Devsinn Technologies
- Base
- Nottingham, United Kingdom
- Companies House number
- Being confirmed
- ICO registration
- Being confirmed
- Cyber Essentials
- Not yet certified. We follow the controls and can help you prepare.
Sub-processors
The providers used on your project (hosting, AI model and communication tools) and their regions are listed in your data processing agreement before any work with personal data begins. Ask us for the current list at any time.
Sources and guidance
Security questions, answered.
Will you sign our data processing agreement?
Yes. We can sign yours or provide ours. Either way it sets out what personal data we process, why, where, for how long, and how we protect it, before any work with personal data begins.
Can you work inside our own Microsoft 365 or cloud account?
Yes. Many clients prefer that. We work in your tenant with accounts you control, so your data never leaves your environment and you can remove our access at any time.
Do you hold Cyber Essentials certification?
Our certification status is being confirmed and will be shown here once held. In the meantime we follow the Cyber Essentials controls in how we work and can help you prepare for certification.
How long do you keep our data?
Only as long as the work needs it. At the end of an engagement we return or delete project data as agreed in the contract and confirm in writing when it is done.
Have a security questionnaire?
Send it over. We complete supplier security and data protection questionnaires as part of every proposal.