Documents, not advice

Products

Much of the documentation an organisation needs when it uses an AI provider follows the same structure from one organisation to the next. Those documents are available here as editable templates, drafted by a CIPP/E certified practitioner and checked against the providers’ published terms and the primary legislation.

Need it written for your specific setup instead? That is the £500 scoping review. Free versions of several checklists are on the sample deliverables page.

Editable templates

£49

AI API GDPR Compliance Pack: OpenAI, Anthropic and Google Gemini

If your organisation sends personal data to the OpenAI API, the Anthropic API or the Gemini API, a data protection review will ask what the provider's terms say about training, retention, data location, transfers and sub-processors, and whether you hold the documents the UK GDPR and the EU GDPR expect. This pack gives you those documents as editable Word templates, with the provider positions already researched.

  • A provider contract review checklist comparing OpenAI, Anthropic, the Gemini Developer API and Vertex AI on fourteen points, each with its source
  • A DPIA for an LLM API integration, an international transfer assessment, a legitimate interests assessment and records of processing entries
  • Privacy notice wording, including the UK right to complain to the controller in force since 19 June 2026
  • A retention and zero data retention record, with request letters for OpenAI and Anthropic
  • Provider positions as published on 4 October 2026. Where a provider's own documents conflict, the templates set out both statements
Get the pack for £49

Twelve editable Word templates and a guide:

  1. Provider contract review checklist. OpenAI, Anthropic, the Gemini Developer API and Vertex AI side by side on fourteen points, from the processing agreement to deletion and audit rights, each with its source.
  2. Data processing agreement. For organisations that provide AI-enabled services to clients, with drafting notes on keeping your promises within the AI providers' own terms.
  3. AI sub-processor schedule. With client change notices.
  4. DPIA for an LLM API integration. With a screening test based on the ICO's list.
  5. Legitimate interests assessment. For sending personal data to an LLM API.
  6. International transfer assessment. Under the UK GDPR, as amended by the Data (Use and Access) Act 2025, and the EU GDPR.
  7. Records of processing entries. For controllers and processors.
  8. Privacy notice wording. Including the UK right to complain to the controller in force since 19 June 2026.
  9. Retention and zero data retention record. With request letters for OpenAI and Anthropic.
  10. Staff AI use policy. Which tools are approved, what may be entered into them, how outputs are checked and how to report a problem.
  11. Automated decision-making assessment. Under UK GDPR Articles 22A to 22D, with a human review procedure.
  12. Go-live checklist and evidence log. Including the EU AI Act transparency and prohibited-practice checks.
  13. Guide. Which templates you need and how to start.

Templates and general guidance, not legal advice. Provider terms change, so confirm each provider position against the live source before relying on it. Licensed for use within the purchasing organisation, including for its clients’ matters.

Purchases are delivered through Gumroad. If the pack is revised, the latest version is available in your Gumroad library at no extra cost. Templates and general guidance, not legal advice.