What must the privacy and security review actually check?

Has the supplier used the current UK legal position?

The ICO’s update dated 19 June 2026 says all data-protection provisions of the Data (Use and Access) Act 2025 are in force. The Act amends rather than replaces UK GDPR, the Data Protection Act 2018 and PECR; some individual ICO guidance pages remain marked for review. Ask the reviewer to identify the rules and guidance used, rather than accepting an old GDPR checklist unchanged. (ico.org.uk)

Are recording, transcription and reuse separately explained?

Require a purpose and lawful-basis assessment for the actual activities, including recording, transcription, quality review and any model-training use. ICO guidance distinguishes using AI to deliver a service from using personal information to develop or improve a model; one justification does not automatically establish the other. (ico.org.uk)

Privacy information should explain relevant purposes, lawful bases, recipients, retention and rights. As an additional desk trust standard, tell callers they are speaking to an automated assistant and provide a practical route to human help; this recommendation is not a claim that every UK AI interaction has an identical statutory disclosure requirement. (ico.org.uk)

Are processor responsibilities enforceable?

Where the arrangement is controller–processor processing, the contract must address documented instructions, confidentiality, security, subprocessors, rights assistance, relevant controller assistance, end-of-contract provisions and audits. Ask for terms covering the actual agency and underlying services—not just the telephony provider’s terms. (ico.org.uk)

Does “UK hosting” describe the whole data path?

The ICO explains that making UK-held personal information accessible to a separate organisation outside the UK can constitute a transfer, including through remote access. Identify overseas support, model providers and logging services as well as the main database location. (ico.org.uk)

Where restricted-transfer rules apply, the relevant organisation must establish an appropriate route. The ICO describes adequacy regulations, appropriate safeguards and exceptions; its current guidance also explains the data-protection test associated with transfer risk assessment. (ico.org.uk)

Has the DPIA decision been documented?

The ICO requires a case-by-case assessment and says an organisation that concludes an AI use is not high risk should still document that conclusion. Where a DPIA identifies residual high risk that cannot be sufficiently reduced, prior consultation with the ICO is required. (ico.org.uk)

Can an attacker talk the agent into exceeding its authority?

NCSC guidance recommends deterministic safeguards that constrain system actions rather than relying only on the model to reject malicious instructions. Translate that into purchasing requirements: narrowly scoped permissions, application-level booking rules, restricted data retrieval and approval for sensitive changes. (ncsc.gov.uk)