Privacy and AI governance, built for UK law first
The Data (Use and Access) Act 2025 rewrote large parts of the UK GDPR, and the Data Protection Act 2018 adds obligations most privacy tools barely touch. The Waivern Governance Tool covers both, and it is free to use on our hosted service.
The UK rules have moved
Recent changes to UK data protection law, and where each one shows up in the Waivern Governance Tool.
Part 3 logs no longer record the justification
In the tool: Logging statements for law enforcement processing (s.62) no longer need the justification for consultation or disclosure.
National security moves to section 78A
In the tool: National security leaves the Part 3 restriction grounds for its own exemption, shown in Part 3 restrictions and the s.78A exemption.
Most UK GDPR amendments come into force
In the tool: Recognised legitimate interests, Articles 8A and 22A-22D, the new transfer rules and the request clock, throughout the UK GDPR features.
Section 164A complaints duty in force
In the tool: Complaints, with the 30-day acknowledgement clock.
UK law asks for more
Since the Data (Use and Access) Act 2025, the UK rules have diverged from the EU's, and the Data Protection Act 2018 adds obligations of its own.
Since the Data (Use and Access) Act 2025, the UK rules have diverged: recognised legitimate interests, new rules on further processing, and Articles 22A to 22D on automated decisions.
Schedule 1 conditions and appropriate policy documents, Schedule 2 and 3 exemptions, the section 164A complaints duty and, for competent authorities, Part 3. These are obligations most privacy tools barely touch.
An AI register is only useful if it includes the systems nobody has assessed yet. The point is to see what is running unexamined.
When a decision is questioned, you need to show who made it, when and why - and that the record has not been changed since.
Who it's for
UK organisations of any size, and the people in them who answer for data protection and AI.
Records of processing, assessments, requests, breaches and complaints in one place, in UK organisations of any size.
Public authorities under section 7 of the DPA 2018, with the public task restriction on legitimate interests and a mandatory DPO.
Police forces, prosecutors, prisons and probation, and others under Schedule 7, who need Part 3 of the DPA 2018 rather than the UK GDPR.
Anyone keeping an AI register, assessing AI risk, or publishing an Algorithmic Transparency Recording Standard record.
Each legal entity says which law it is subject to: UK, EU or both. UK-only questions are hidden for an EU-only entity.
Built for UK law first
Depth in UK privacy and AI law, checked against the current text on legislation.gov.uk. Each rule lives in a small module that cites the provision it implements.
The UK GDPR as the Data (Use and Access) Act 2025 left it, with red flags for what would fail an inspection and amber for what is merely incomplete.
Schedule 1, Schedules 2 and 3, section 164A complaints, data sharing agreements, public authorities and Part 3 law enforcement processing.
Cookies and similar technologies, electronic marketing and its basis, and breach notification for public communications providers.
An AI register, risk assessment with the UK government's AI Risk Management Toolkit, and Algorithmic Transparency Recording Standard records. The EU AI Act is deliberately not applied.
How it works
It records, routes and evidences decisions. It does not make them: a named person always does.
Describe how your organisation is structured, and which law applies to each part of it.
- Legal entities subject to UK law, EU law or both
- Public authority and competent authority settings
- A step-by-step setup guide, measured against what the registers actually hold
Keep the registers in one place, each checked against what the law requires.
- Processing, AI systems, requests, breaches and complaints
- Red flags for what would fail an inspection, amber for what is incomplete
- Single-use links to ask someone without an account specific questions
Assessments go to the right people, and a named person always decides.
- Assessments from versioned templates, routed to approvers chosen by the answers
- A risk register with appetite, treatment and named, dated risk acceptance
- An optional assistant, on a model you choose and control, that drafts and explains but never decides
Every change lands in an append-only audit trail, so when the ICO asks why, you can show them.
- Hash-chained, so an altered entry breaks everything after it
- Exports carry what a recipient needs to verify the chain themselves
- Exports are scoped to each person's access, and are recorded too
Read every rule it applies
Each legal rule lives in the code beside the provision it implements. Read it, try it on our hosted service, and tell us what UK law we've missed.
What you gain
Registers that show their own gaps, decisions that carry their reasons, and a record that stands up when someone asks.
Red flags for what would fail an inspection, amber for what is merely incomplete, across every register.
A tamper-evident audit trail that anyone you send it to can verify for themselves.
Automated decisions are linked to the processing they belong to, so your AI register and your record of processing agree.
Every rule cites the provision it implements, and the date it was checked against legislation.gov.uk.
Every decision has a named person, a date and a reason, from assessment approvals to risk acceptance.
It holds categories of personal data and the decisions about them, not individuals' data. It does not index systems or read logs.
Free, with services if you want them
The software and our hosted service are free. What we charge for are services around them.
Open source under the GNU Affero General Public License v3.0.
- The software: use it, study it, change it and share it
- Our hosted service
- Every feature - nothing is held back
Talk to us about what your organisation needs.
- Technical support
- A dedicated instance of your own, run by Waivern, instead of the shared hosted service
- Training for your staff
- Custom modifications to fit how your organisation works
Frequently Asked Questions
See what UK-first looks like
Try it on our hosted service, read the code on GitHub, or talk to us about support, training, a dedicated instance or tailoring.