Sources and legal force
Legislation, regulatory guidance, technical recommendations and a proposed agreement serve different purposes. Check the current rules and actual facts before taking a business decision. Source cut-off 4 November 2026.
GDPR · EU legislature
Legislation · EU GDPR, Articles 3–6, 9–10, 13–14, 22, 25, 28, 32–36 and 44–49
Check scope, Member State rules and actual role.
UKGDPR · UK legislation
Legislation · UK GDPR, especially Articles 22A–22D, 28 and 32–36
UK changes and commencement are separate from EU law.
ICO28 · UK Information Commissioner
Regulator guidance · Article 28 contract terms and assistance
Check all mandatory terms in a binding agreement and actual role. Guidance carries reform review notice.
TRANSFER · UK Information Commissioner
Regulator guidance · Are we making a restricted transfer?, including cloud
Consider the exporter, legal recipient and onward processing, including support.
EUTRANSFER · European Data Protection Board
Final guidelines · Guidelines 05/2021 v2, three criteria and employee example
A separate recipient is distinct from an employee acting as part of the same entity. Security still matters.
CLOUD · UK National Cyber Security Centre
Recommended technical practice · Cloud security principles, especially 2, 3 and 8–14
Configuration, identity, access, derived data, supply chain, resilience and customer responsibility.
NCSC · UK National Cyber Security Centre
Recommended technical practice · Secure AI system development, four lifecycle phases
Applies to API-based systems and hosted models as well as systems developed in-house.
OWASPAPI · OWASP
Technical awareness guidance · API Security Top 10, API1:2023 object-level authorisation
Object authorisation and resource use need controls outside the model.
CNIL · French data protection authority
Regulator recommendations · AI system development and GDPR
Development includes design, datasets and training. It does not provide a permission for arbitrary data.
EDPB28 · European Data Protection Board
Adopted opinion · Opinion 28/2024, especially anonymity paragraphs 38–45 and legitimate interests
Anonymity and lawful grounds are case-specific; a supplier assertion or synthetic label is insufficient.
ICOAI · UK Information Commissioner
Regulator guidance · AI security, minimisation, synthetic data and retention
Use risk-based measures and review under current UK law.
GPAI · European Commission AI Office
Interpretative Q&A · General-purpose models, downstream modification and scope
Fine-tuning alone does not settle provider status. Q&A is interpretative and is not binding legal advice.
AIA2 · European Commission AI Act Service Desk
Official article text · EU AI Act Article 2, scope
Check operative law and territorial scope.
AIA5 · European Commission AI Act Service Desk
Official article text · EU AI Act Article 5, prohibited practices
Screen actual intended use and specific exceptions.
AIA25 · European Commission AI Act Service Desk
Official article text · EU AI Act Article 25, value-chain responsibilities
Specific high-risk circumstances and written supplier assistance. Check applicable dates.
AIA50 · European Commission AI Act Service Desk
Official article text · EU AI Act Article 50, transparency
Different actors and duties for interactions and output. Check current exceptions and timing.
AIA2026 · EU legislature
Amending legislation · Regulation 2026/1744, amendments and application dates
Read current law for actual release date. Do not use a single high-risk deadline for every duty.
PECR · UK legislation
Legislation · PECR regulation 6 and Schedule A1
Current statistical-purpose exception subject to all conditions; read regulation 6 together.
ICOAB · UK Information Commissioner
Final regulator guidance · Storage/access technology exceptions, statistical-purpose A/B example
Final April 2026 guidance. Narrow UK route, information and simple free objection. Indexed official guidance where direct access is blocked.
EPRIV · EU legislature
Directive with national implementation · ePrivacy Directive 2002/58/EC consolidated Article 5(3)
Check Member State law and authority conditions. Do not copy the UK exception to EU users.
ICOACCURACY · UK Information Commissioner
Regulator guidance · AI accuracy and statistical accuracy
Match evaluation to actual task and people; record uncertainty.
CMA · UK legislation
Legislation · Computer Misuse Act 1990, sections 1, 3 and 17
Scope and authority matter. No general testing permission over a supplier or other tenant is conferred.
EDPBBREACH · European Data Protection Board
Final guidelines · Guidelines 9/2022 v2, awareness, roles, thresholds and territorial reporting
Apply regulator and affected-person tests separately, with processor and controller obligations.
ICOBREACH · UK Information Commissioner
Regulator guidance · Personal data breaches guide
Includes all confirmed personal-data-breach records and reporting decisions.
ICOERASE · UK Information Commissioner
Regulator guidance · Right to erasure and backup handling
Check legal exceptions, beyond-use treatment and deletion replay during restoration.
UKIP · UK legislation
Legislation · CDPA 1988 section 29A
UK text/data analysis exception is subject to non-commercial-research and other conditions. Check separate rights and actual activity.
EUIP · EU legislature
Directive with national implementation · DSM Directive 2019/790, Articles 3–4
Check qualifying bodies, lawful access, reservations, permitted acts and national implementation.
UKIPREPORT · UK IPO, DSIT and DCMS
Government policy report · Copyright and AI report, 18 March 2026
Existing law and policy proposals must be distinguished. No default promise of exclusive or cleared output rights.
LSA · UK legislation
Legislation · Legal Services Act 2007 section 12
England and Wales reserved legal activities; actual permissions and other regimes require assessment.
LSB · UK legislation
Legislation · Legal Services Act 2007 section 13
Entitlement to carry on reserved activities, authorisation and exemptions. Not a global practice licence.
UCTA · UK legislation
Legislation · Unfair Contract Terms Act 1977 section 2
Check statutory scope, reasonableness and non-excludable negligence liability with actual parties and terms.
PRIVILEGE · UK Supreme Court
Judgment · Prudential, UKSC 2010/0215, [2013] UKSC 1
Legal advice privilege and non-lawyer advice. Other privilege tests and facts require independent assessment.
DPO · UK Information Commissioner
Regulator guidance · Data protection officers
Expertise, independence, resources and conflicts for designated DPOs.
UKCARE · UK legislation
Legislation · Supply of Goods and Services Act 1982 section 13
Reasonable care and skill in relevant business service contracts, subject to actual statutory scope.
Toto-Rex can make mistakes. Everything here is general information, not legal advice: check the primary source, and take advice from a qualified professional before you act.