Documents for the next decision
These British-English templates are blank. Read the stated purpose and complete the facts before use. The processor schedule is a draft for negotiation; actual agreement and required transfer instruments must be completed separately.
Form 01 · AI use, architecture and data approval
Complete before connecting real records, buying a material service or changing a permitted use. This is an internal decision record.
GDPR · UKGDPR · NCSC · AIA2 · AIA5 · AIA25Form 02 · Cloud and API supplier due diligence
Use the actual product, tenancy and purchased plan. Record answers as verified, supplier assertion, unknown or not applicable with reasons. A questionnaire answer does not amend a contract.
CLOUD · ICO28 · TRANSFER · NCSC · GDPR · OWASPAPIForm 03 · Dataset, annotation and training-run record
Complete for each dataset version and training or fine-tuning run. Retrieval and evaluation datasets also require provenance and lawful-use checks.
GDPR · UKGDPR · CNIL · EDPB28 · ICOAI · GPAIForm 04 · API integration and retrieval security acceptance
Engineering acceptance record for the assembled application. Use fictional fixtures and a private test environment. No external target is authorised by this form.
GDPR · CLOUD · NCSC · OWASPAPIForm 05 · Red-team authorisation and rules of engagement
Proposed engagement record. Testing may start only after parties with actual authority over each target have accepted the scope and necessary provider permissions are recorded. It does not bind a third party.
CMA · NCSC · GDPRForm 06 · A/B experiment protocol and stop decision
An internal plan for one comparison. Complete legal and operational prerequisites before assigning a real person or reading/writing a device identifier.
GDPR · UKGDPR · PECR · ICOAB · EPRIV · ICOACCURACYForm 07 · Evaluation report and release sign-off
Internal approval for the exact version and use tested. An unknown required legal condition or unfinished prerequisite is a hold.
GDPR · UKGDPR · NCSC · AIA25 · AIA50 · ICOACCURACYForm 08 · Operations, change and breach response record
Use for material change, harmful output or suspected security event. Keep personal evidence in restricted storage and share references rather than copies.
GDPR · UKGDPR · EDPBBREACH · ICOBREACH · NCSCForm 09 · Backup, recovery and exit plan
Use before material supplier dependence and again before migration, sale or shutdown. Record actual obligations and technical constraints.
GDPR · UKGDPR · CLOUD · ICO28 · ICOERASEForm 10 · Reader notices and preference wording
Adaptable drafting prompts. Complete the facts and legal route before publication. Notices, consent, processor contracts and a lawful basis are distinct requirements.
GDPR · UKGDPR · PECR · ICOAB · EPRIVForm 11 · Controller–processor and AI service schedule · draft for negotiation
Proposed terms only. Complete and reconcile this schedule with the services agreement, applicable law, actual roles and any mandatory transfer instrument. It takes effect only through valid agreement by authorised parties. If the supplier determines its own purpose, assess and document that purpose and role separately; a processor label cannot change the facts.
GDPR · UKGDPR · ICO28 · TRANSFERFull handbook · Editable workbook
Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.