Copy this result card into the management meeting or supplier brief:
| Result field | Your entry |
|---|---|
| Workflow and exclusions | ____ |
| Total score and band | ____ / 45; ____ |
| Launch conditions | Met / Not met |
| Blocking questions and evidence needed | ____ |
| Best alternative to a bespoke agency | ____ |
| Three actions before the next decision | ____ |
| Action owners and review date | ____ |
| Proposed pilot spend cap and stop rules | ____ |
| Decision | Improve process / Configure existing software / Compare suppliers / Prepare pilot / Controlled live pilot / Do not buy |
For an agency conversation, share the workflow, redacted evidence and unresolved questions—not an unrestricted customer database. Ask the supplier to demonstrate how it will close the gaps, then rescore the same workflow. ICO guidance on AI security and data minimisation supports limiting personal information to what is necessary for the purpose. (ico.org.uk)
For privacy due diligence, look beyond the supplier’s registered address. The ICO explains that allowing a separate organisation outside the UK to access personal information remotely can constitute a restricted transfer, including where the information remains on UK systems. (ico.org.uk)
Legal and evidence boundary: Several ICO pages consulted state that guidance is under review following the Data (Use and Access) Act. Recheck the applicable guidance and obtain suitable advice before launch; this quiz does not certify compliance. Supplier documentation establishes stated capabilities and terms, not independently audited HVAC outcomes. (ico.org.uk)
Sources cited on this page
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk
- ico.org.uk ↗ico.org.uk