Back to CallCamIT

UK legal compliance

What the software does toward UK GDPR, the Data Protection Act and the statutory clocks — and what remains the controller's job.

This is not legal advice, and no software can make an organisation compliant on its own. Data protection duties fall on the controller — your organisation — not on the tool it happens to be using. What CallCamIT can do is carry out the technical measures the law expects, keep the registers with the statutory clocks running, generate honest first drafts of the documents you must hold, and fail loudly when a deadline is being missed. What it cannot do is decide your lawful basis, consult your staff, apply an exemption, or sign your DPIA. Those need a person, and for anything contentious, your DPO or a solicitor.

Researched against the law as it stands in August 2026, which matters here: the Data (Use and Access) Act 2025 changed several things that older guidance still gets wrong.

What changed in 2025–26, and what it means here

Choose the sector at install

Duties differ by who is running the software, and guessing wrong is expensive in both directions. The sector is picked at install — Controller → Compliance — and drives retention defaults, which documents are required, which checks run, and what the generated documents say.

Choosing several takes the union of the duties and the longest retention period, which is the safe direction when two regimes disagree.

What the software actually does

Transparency (Arts. 12–14). A first-run notice that cannot be dismissed until it has been scrolled, shown before the first ticket. It is deliberately not a consent dialog — consent is the wrong lawful basis at work, because it is rarely freely given when your employer is asking. It says "I have read this", and the acknowledgement is evidence of transparency, not of consent.

Rights (Arts. 15–22). A register with the statutory clock, and the work behind each right:

• Access assembles every ticket, event, message, device record and admin action naming the person — plus the purposes, recipients, retention and their other rights, which Art. 15(1) requires alongside the copy and which a bare data dump does not satisfy. It reminds you to check for third-party personal data before sending.
• Erasure empties personal content while keeping the audit skeleton, and the response text explains exactly what was kept and why. Art. 17 says delete; Art. 32 says keep a trail. The fact an event occurred is a security record; its content is personal data. That distinction is the resolution, and the person is told about it rather than left to assume everything is gone.
• Restriction actually stops Cam: a restricted person's tickets are held for a human and no automated action touches their accounts.
• Portability runs, but the response says plainly that Art. 20 is narrower than people expect and which parts are the right and which are goodwill.
• Human review lists every significant decision affecting them and who confirmed it by name.
• A refusal must cite a ground from Art. 17(3) and tell the person they can complain to you, complain to the ICO, and seek a judicial remedy. Omitting those three is itself a breach of Art. 12(4).

Complaints (DPA 2018 s.164A). Register, 30-day acknowledgement clock, and the records the ICO can inspect.

Breaches (Arts. 33–34). The 72-hour clock runs from awareness, not from having the full picture, because that is what the Article says and it is the distinction people get wrong. The assessment follows Art. 33: not notifiable only where the breach is unlikely to risk people's rights — and even then you must record why you reached that view.

International transfers (Chapter V). Ticket text going to a hosted model is a restricted transfer. CallCamIT blocks it until a mechanism and a data protection test are recorded. It uses the local model instead where that PC has one that can answer; where it has none, the ticket is held for a person with CC-7006 and nothing is sent. Azure OpenAI in a UK region is correctly treated as no transfer at all; the region is what matters, not where the vendor is incorporated.

Special category data (Art. 9). Health, disability, union membership, religion, sexual orientation and criminal-offence content is detected in tickets and never sent to a hosted provider (Anthropic, OpenAI, Azure OpenAI or an OpenAI-compatible endpoint), whatever the transfer paperwork says: the local model answers it, or, where that PC has no local model that can, the ticket is held for a person with CC-7006. The screen does not apply to the local engine's own address: if that is pointed at a server on another machine, every ticket goes there, with the off-site acknowledgement as the only control, so use the OpenAI-compatible option for a server of your own. Nor does it apply to Admin Cam: the screen covers tickets only, and the instructions an administrator types into Admin Cam, with the directory results Admin Cam reads, go to the hosted provider unscreened when one is configured and its transfer is assessed, so keep health and the other categories above out of them. What Admin Cam does withhold from the model is a secret its own tools return, such as the temporary password it generates for a new account, which the console shows to the administrator instead. The ticket screen over-flags on purpose: a false positive keeps one ticket on the PC, or at worst holds it for a person; a false negative sends someone's health information to the provider. It detects that a ticket is likely to contain such content and records the category it matched, never the words or a condition. The person is not told unless the ticket is held, when its note says which category kept it on the PC; the resolution published to the estate share does not.

Monitoring (ICO Employment Practices). Per-ticket authorisation the person gives and can revoke, a blue cursor and a banner throughout, a full log of what was read, and nothing covert. The generated worker notice says what CallCamIT is not used for — productivity, hours, browsing — because the ICO expects workers to be told the purpose, and "IT support" only means something if the boundary is stated. Where an administrator has switched standing access on, or set approvals to skip, the notices and the DPIA say so instead of describing the per-ticket grant: a notice that describes a stricter system than the one running is not transparency. Cam refuses to type into any control Windows marks as a password box, so "it will not type your password" is enforced rather than instructed.

Internet research. When it is on, a short search phrase built from the error text goes to DuckDuckGo, and Cam reads pages from a fixed list of sites, GET only: vendor documentation and support sites, the NCSC, the ICO, NIST and MITRE, and three technical question-and-answer sites (Stack Overflow, Server Fault and Super User). Email addresses, IP and MAC addresses, directory identifiers, share paths, UK postcodes and phone numbers, user folder names, labelled secrets and long codes are removed from the phrase first. A person's name, a username or a computer name written into the error text is not a shape that step recognises, so Cam is told to leave them out, and every phrase sent is on the ticket record. The address of a page Cam reads is checked against that list and is never rewritten: a query addressed to the search engine itself is refused, so a search goes out only as the scrubbed phrase, and an address carrying any of the identifiers above, in the forms these patterns recognise, is refused rather than fetched, with two allowances. In the host and path of any address, a long code counts only as 32 or more characters with no hyphen that hold both a letter and a digit, so a long hyphenated title or a code split by hyphens goes out as written. And a GUID or long code outside the query string of an address the search itself returned is read as that page's name. Every page request is on the ticket record too. The privacy notice, the worker notice, the Article 30 record and the DPIA all disclose it, because "does anything leave? No" was not accurate while it did.

Documents. Article 30 record, DPIA, privacy notice, worker monitoring notice and accessibility statement, all generated from the live configuration so they cannot drift from what the software is doing. Each is labelled a draft, and the DPIA leaves consultation and the necessity assessment blank for a human, because those are the sections that carry the argument.

What you must still do yourself

The troubleshooter's UK data protection review fails until these are recorded, and that failure is correct — it is not a nag to switch off.

1. Name the controller and a data protection contact. Every notice and every rights response needs somewhere for a person to go.
2. Decide and document your lawful basis. For workplace IT support this is normally legitimate interests, which needs a written three-part balancing test. Consent is a poor fit.
3. Complete and sign the DPIA before you deploy. Art. 35 says before. This processing is high risk on five counts at once — systematic monitoring at work, automated decisions with significant effects, special category data, large-scale employee data, and innovative technology. Any two would trigger it.
4. Consult your staff about the monitoring, and write down what they said and what you changed. The ICO expects their views to be sought. Where a union is recognised, consult it. This is the section that most often decides whether a DPIA persuades anyone.
5. Issue the notices. A notice on an intranet page nobody visits is not transparency.
6. Set retention to your own schedule. The defaults are a starting point.
7. If you enable a hosted model: identify the Chapter V route, complete the data protection test, and get the processor contract right (Art. 28). Or don't — running locally needs none of this, and is the simplest exit plan there is.
8. If you are a public authority: test the accessibility statement before publishing it. An automated check finds perhaps a third of the problems.
9. Article 9 condition and appropriate policy document, if special category data is arriving — and it will. Most DPA 2018 Sch. 1 conditions require the policy document, and it is the piece most often missing.
10. Forward the audit trail to your SIEM. A tamper-evident local database is still one copy.

Honest limits

• A generated DPIA is a first draft. It knows the data flows exactly, because it is the system. It does not know your organisation, your other systems, or your risk appetite.
• Special category detection is heuristic. It will miss things phrased unusually. It reduces the volume of sensitive content leaving the UK; it does not reduce it to zero.
• The software cannot apply an exemption, run a public interest test, or decide whether a breach is notifiable. It tracks the deadline and gives you the framework.
• Nothing here addresses function creep. No technical control stops an employer using ticket data for performance management. That is a policy matter, and the DPIA says so rather than pretending otherwise.

Sources

Researched August 2026 against: Littler on DUAA commencement · CMS on the complaints regime · Kennedys on the 2026 international transfer guidance · Farrer on ICO workplace monitoring guidance · ICO transfer risk assessment guidance