GDPR, the way procurement actually asks for it
Most platforms put a "GDPR compliant" badge on their footer and hope no one reads the regulation. SkillDrill ships the actual articles as working features. Subject access in two clicks. Erasure that cascades. A real Record of Processing Activities. Per-category consent with history. Automated retention so applicant data doesn't sit forever.
Aligned with UK GDPR, EU GDPR, the UK Age Appropriate Design Code, the California CPRA, the Australian APP, and the DIFC data protection law.
If your DPO has a question, it has an answer here
SkillDrill processes personal data about your staff and your applicants. That makes you the controller and us the processor under GDPR. We have built the platform so that the rights and obligations you owe your data subjects are operations you can perform inside the product, not engineering tickets you raise with us.
Below is the practical mapping. Each item names the article, says what the product does, and tells you where to find it.
Subject rights
When a data subject asks, you have an answer ready
Right of access (SAR)
Generate a complete subject access export in JSON or as a per-table CSV ZIP. The export covers staff records, profile responses, skills, audit log entries, AI usage events, applicant records, and previous privacy requests. Decryption uses the tenant key.
Identity gate: exports require a verified privacy request. Verification is by email confirmation or recorded ID check, not just an admin clicking a button.
Rectification
Corrections are recorded in a separate, append-only rectification log. The original value, the corrected value, who requested it, and who actioned it are all captured.
Why append-only: so a subject can prove their record was wrong, not just that it is right now.
Right to erasure
Erasure cascades. When you erase a subject, every linked record across staff profiles, applicant submissions, AI conversation transcripts, notes, tags, and skills is removed or pseudonymised in a single operation, with a full audit trail of what happened.
What survives: only the audit log, with the subject's name replaced by "[erased]". You can prove the right was honoured without keeping the data.
Automated decision-making disclosure
Applicants are told upfront that AI helps with skill extraction and compatibility scoring. Every score includes a breakdown of what was matched and what was not. Any applicant or admin can request human review of an AI decision.
Why it matters: Article 22 says people have the right not to be subject to a decision based solely on automated processing. Human review keeps you the right side of that line.
Article 30
A real Record of Processing Activities, not a Word doc
Article 30 requires controllers to keep a record of every processing activity: purpose, legal basis, categories of data, recipients, retention period, and security measures. Most teams keep this in a spreadsheet that is out of date the day after it is finished.
SkillDrill's Privacy Register is built into the admin. Each module that processes data has a card with all six fields filled in. When you change retention or add a new sub-processor, you change it in one place.
Audit logging
- Purpose
- Security monitoring, accountability under Art. 5(2), dispute resolution.
- Legal basis
- Legitimate interest (Art. 6(1)(f)), legal obligation for security records.
- Categories
- Action metadata, actor, IP address, user agent, target reference.
- Recipients
- Internal admins for review only. Never shared externally.
- Retention
- Indefinite, pseudonymised on subject erasure (name replaced by "[erased]").
- Security
- Insert-only enforced at the model layer. IP addresses anonymised after 90 days by cron.
Operational compliance
The unglamorous stuff that gets you through an audit
Per-category consent, with history
Consent is not one switch. SkillDrill captures and stores it per category: essential, marketing, analytics, AI training. Each user sees what they have agreed to and what they can change, and every change is recorded with a timestamp so you can prove what was true on a given date.
Withdrawal works: when a category is withdrawn, processing stops for that purpose immediately. There is no flag-and-forget.
Automated retention
Scheduled jobs run on cron without human intervention. Old data is aged off according to your tenant policy, applicant records are deleted once they pass their configured retention window, and outstanding privacy requests are chased before the 30-day deadline.
You set the windows: per-tenant retention is configurable. The defaults are conservative.
Children's data, UK AADC aware
The application flow includes an age gate before any AI conversation starts, and the apply experience adapts under the UK Age Appropriate Design Code. AI disclosure language and consent capture are tuned to age, not just to jurisdiction.
Why this matters: the AADC applies to any service likely to be accessed by children in the UK. If you let people under 18 apply, this is your problem too.
Incident log and 72-hour notice
If something goes wrong, the incident log captures what happened, who was affected, what data categories were involved, and the timeline. A regulator-notice email template is ready to go so the 72-hour notification under Article 33 is a fill-in, not a scramble.
What we do for you: we will notify you of any incident affecting your tenant within 24 hours, with the technical detail your DPO needs.
If you have a procurement questionnaire in front of you
Here is the short version. Hand this section to whoever is asking.
- Where is data stored?
- UK-region cloud infrastructure. No transfers outside the UK or EEA without your explicit configuration.
- Encryption at rest?
- AES-256-GCM with per-tenant keys derived via HKDF-SHA256. Even our database administrators cannot read your data.
- Encryption in transit?
- TLS 1.2+ for every connection, including to third-party AI providers. HSTS enforced.
- AI training on our data?
- No. AI providers are configured to not retain or train on tenant data. You can use your own AI API key for full control.
- Sub-processors?
- Listed in the DPA and in your in-product Privacy Register. We notify of changes 30 days in advance.
- Subject access response time?
- Self-service from inside the product, normally within minutes once identity is verified. Statutory limit is 30 days.
- Data Processing Agreement?
- Standard DPA available at /dpa. Bespoke wording available for enterprise customers.
- Penetration testing?
- Detailed in our security page.
Have a procurement question we have not covered?
Send it across. We will reply with a written answer you can paste straight into your assessment.