What happens to your data when a supplier builds your software.

You decide why and how personal data is used, which makes you the controller and puts the legal obligation on you. A supplier acting on your instructions is a processor. That remains true even when the supplier knows far more about the technology than you do, and it remains true when the supplier is a one-person studio or a large consultancy. The ICO’s detailed guidance on controllers and processors exists to settle exactly this question, and its answer turns on who decides the purpose and the means, not on who holds the servers.

It matters because the regulator will come to you, not to them. Which is precisely why the agreement between you needs to be written rather than assumed. The ICO puts it plainly: whenever a controller uses a processor to process personal data on their behalf, a written contract needs to be in place between the parties, and if the processor uses a sub-processor, it needs a written contract with them too.

Software that calls an AI model adds a layer most agreements from before 2023 never contemplated. Every request that leaves your system and reaches OpenAI, Anthropic, Google or Microsoft is processing by a sub-processor. Their terms decide whether your data trains a model, how long it is kept and in which country it is stored, and they differ between the consumer, business and API versions of the same product. This guide covers the contract, the transfer rules, the provider terms and the practical arrangements, in that order.

The ICO publishes a checklist for the controller-processor contract. It has two parts: the description of the processing, and the eight clauses the contract must include. A supplier’s standard data processing agreement should map onto this table line by line; if it does not, ask for the missing lines before signing. The right-hand column is the question to put to the supplier for each line, because the clause is only worth having if the supplier can say how it is met in practice.

From the ICO’s Guide to UK GDPR, contracts checklist, read 14 September 2026. The processor must also give the controller the information it needs to show both are meeting Article 28.

The provider of the AI model is a sub-processor, and its terms are the part of the chain a buyer most often never reads. The difference that matters is between the consumer product and the business or API product with the same name: the consumer version may train on what it is sent unless the user opts out, and the business version does not by default. A build should only ever use the second kind. Read on the providers’ own pages in September 2026, the position is this.

Vendor statements, read on the vendors’ own pages; they change, and the date read is the date to check against. Regions are options that a builder must switch on; the default is often global.

If personal data is sent, or made accessible, to a separate organisation outside the UK, the ICO calls it a restricted transfer, and every restricted transfer must be covered by one of three things: UK adequacy regulations for the destination country, an appropriate safeguard, or an exception. The safeguards the ICO names are its International Data Transfer Agreement (the IDTA), the International Data Transfer Addendum to the EU standard contractual clauses (the Addendum), and UK binding corporate rules. If you rely on a safeguard you must also complete a transfer risk assessment to check that the standard of protection for people’s information is not materially lower after the transfer. If none of the three routes is available, the transfer must not be made.

For a software build the practical questions are where the database sits, where backups sit, and where each model provider processes the request. A supplier who hosts in London and calls a model with a global routing default has made a restricted transfer whether they meant to or not. The provider pages above show what can be pinned: OpenAI offers UK and European residency at a 10 per cent uplift on newer models; Google’s Vertex AI lists London as a region for Gemini and for Claude models; Anthropic’s first-party API currently offers US or global inference and US-only storage; Microsoft offers the EU Data Boundary for Copilot. Each is a setting, and each costs something, so it belongs in the scope.

The Data (Use and Access) Act 2025 restated the test for third-country transfers as whether protection would be "not materially lower", which is the language now used in the ICO’s transfer risk assessment guidance. It also removed the four-year review requirement on adequacy decisions. Neither changes what a small buyer has to do: know where the data goes, and have a mechanism for each hop.

The Act received Royal Assent on 19 June 2025 and, per the ICO’s guidance page updated on 19 June 2026, all of its data protection provisions are now in force, having been phased in between June 2025 and June 2026. It amends rather than replaces the UK GDPR, the Data Protection Act 2018 and PECR, and the ICO’s summary is that most of the changes offer an opportunity to do things differently rather than a new obligation.

Four changes touch a software build directly. Automated decision-making: the Act replaced Article 22 with new Articles 22A to 22D and, in the ICO’s words, opens up the full range of lawful bases you can rely on when using personal information to make significant automated decisions, including legitimate interests, so long as safeguards such as the right to human intervention remain and special category data is not involved. Recognised legitimate interests: a new lawful basis for listed purposes such as crime prevention and safeguarding that removes the balancing test.

Subject access requests: you now only have to make reasonable and proportionate searches, and the clock can be stopped while you seek clarification. Cookies: some storage and access technologies, such as those used for statistics or website functionality, can be set without consent. None of these requires a change to an existing system; each is an option a new build can be designed to use.

There is one new duty: organisations must have a data protection complaints procedure, and the ICO has published guidance on it. For a system that scores, ranks or triages people, the ADM change is the one to design around: the wider lawful basis comes with the same duty to tell people, let them contest the decision and get a human to look at it.

The paperwork matters less than three practical arrangements. First, the systems should sit on your own provider accounts, with the supplier given access rather than ownership: the cloud project, the domain, the model provider organisation, the messaging account. That single arrangement removes most of the ambiguity about what happens if the relationship ends badly, and it means the sub-processor relationship is between you and the provider, on terms you accepted, with the invoices in your name.

Second, the code should be in a repository you own from the first commit, not handed over at the end. Source-code escrow, where a third party holds the code and releases it on the supplier’s insolvency, is the traditional answer for large packaged software; for a bespoke build on your own accounts it is usually unnecessary, because there is nothing to release. If a supplier insists on holding the code and the accounts, escrow is the minimum, and a retainer that exists mainly because they hold the login is not support.

Third, the exit should be rehearsed on paper before it is needed: what is deleted, from where, including backups and the model provider’s retention window, and what written confirmation you receive. The ICO’s end-of-contract clause requires deletion or return at your choice; the practical test is whether the supplier can tell you, today, exactly where every copy of your data is.

Two deadlines fall on you as controller, and both are shortened by whatever the supplier keeps for itself. A personal data breach must be reported to the ICO within 72 hours of you becoming aware of it where it is likely to result in a risk to people. If the supplier’s agreement says "without undue delay" and nothing else, and they take two days to tell you, you have 24 hours left to assess, document and notify. A supplier that commits to notifying within 24 hours leaves you 48. Ask for the number.

A subject access request must be answered within one calendar month, extendable in complex cases and now pausable while you seek clarification under the 2025 Act. If the system holds the person’s data in a database, a search index, a model provider’s 30-day abuse-monitoring log and a nightly backup, the supplier needs to be able to search all four. A supplier who can produce a person’s complete record in a day makes the month easy; one who has to be asked what the system stores does not.

Costs to put against those: a written DPA is a short document for a small engagement, and pinning a model provider to a UK or European region adds about 10 per cent to model spend at OpenAI’s published uplift and 10 per cent at Anthropic’s for US-only inference. On a system whose model bill is tens of pounds a month, the residency premium is pounds. The expensive version of this guide is the one where none of it was done.

Score a proposed supplier against this before signing. Every "no" is a conversation, not necessarily a rejection; a supplier who answers all of them from memory is one who has done this before. The evidence column matters more than the answer, because "yes" is free and a screenshot of the provider settings, a login to the repository, or a dry run of a rights request on a test record is not.

One item on the list is easy to check without asking: the ICO keeps a public register of data controllers, searchable by name or number, and a supplier that processes personal data for a living and is not on it has already told you something about how it treats the rest of the list. The registration number should appear on the supplier’s privacy notice; ours is at the foot of every page.

For transparency, since we are asking you to demand this of every supplier: Augustova Limited is registered with the ICO as a data controller under number ZC152144, and our standard DPA follows the ICO checklist above clause by clause. It names us as processor and you as controller, lists every sub-processor by name and region, excludes model training by using business and API terms only, commits to breach notification within 24 hours of our becoming aware, and provides for deletion or return of all personal data at the end of the engagement with written confirmation.

The practical arrangements are the ones described in this guide because they are ours: systems on your own provider accounts with access granted to us, code in your repository from the first commit, model providers pinned to a UK or European region where the provider offers one, and a DPIA drafted with you before anything touches live personal data. We will send the DPA before you commit to anything, so you can read the terms rather than take them on trust.

The residency and no-training settings are recorded in the handover document with a screenshot of each provider’s organisation settings on the day of go-live, because a setting that was correct at launch and silently changed by a provider’s new default is the failure mode we have seen most often in systems we have been asked to review. The handover also lists every place a person’s data can be found, so that a rights request can be answered from the document rather than from memory.

Every regulatory statement above was read on the ICO’s or gov.uk’s pages on 14 September 2026: the ICO’s contracts checklist and controllers-and-processors guidance, its international transfers guide, its Data (Use and Access) Act page as updated on 19 June 2026, and DSIT’s factsheet on the Act’s UK GDPR changes. Provider positions on training, retention and regions were read on the providers’ own legal and documentation pages on the same day, with effective dates given where the page states one; these are vendor statements and change without notice, so check the date. The 72-hour and one-month deadlines are UK GDPR Articles 33 and 12. Nothing here is legal advice; it is what the sources say, arranged for a buyer.