私隱與 AI 治理平台會儲存甚麼？開發者嘗試建立資料模型

In August 2026 the BBC published a short notice on the UK's Find a Tender service. It asks the market about a "privacy and AI governance platform". It is an RFI, a request for information. A buyer sends one when it wants to ask questions before a real tender, so nobody is buying anything yet. The notice gives no contract value. You can read the notice here.

The text is short. The BBC lists the governance work it does today: Data Protection Impact Assessments (DPIAs), Transfer Risk Assessments (TRAs/TIAs), AI Risk Assessments, risk acceptance, Records of Processing Activities (RoPA), case management and governance reporting. It says this work is done with "a combination of manual processes and existing tools". Now it wants to know if a platform could make this work more efficient, more consistent and more mature.

I read that list as a developer, and I saw a data model.

What each record is

A DPIA is a check for risky projects. The ICO, the UK data protection regulator, says it helps you find and reduce the data protection risks of a project. If it finds a high risk that you can't reduce, you must consult the ICO before you start.

A transfer risk assessment is a similar check for personal data that leaves the UK. An AI risk assessment does the same job for an AI system. Risk acceptance is when someone senior says: we know about this risk, and we accept it. RoPA is a list of what personal data you process and why. UK GDPR asks for it in Article 30.

All of these are records. Each one has an owner, a status and a date. Most of them belong to a system or a project. That is why a spreadsheet works for a while.

A toy model

This is my own example, not the BBC's. It only shows the shape of the problem.

from dataclasses import dataclass
from datetime import date

@dataclass
class Assessment:
    id: str
    kind: str            # "DPIA", "TRA" or "AI_RISK"
    system: str
    residual_risk: str   # "low", "medium" or "high", after fixes
    owner: str
    review_by: date

def needs_ico(a):
    # A DPIA with a high risk you cannot reduce
    # means you must consult the ICO first.
    return a.kind == "DPIA" and a.residual_risk == "high"

def overdue(a, today):
    return a.review_by < today

records = [
    Assessment("A1", "DPIA", "viewer app", "low", "Sam", date(2027, 3, 1)),
    Assessment("A2", "DPIA", "voice search", "high", "Priya", date(2026, 12, 1)),
    Assessment("A3", "AI_RISK", "subtitle model", "medium", "Tom", date(2026, 9, 15)),
]

today = date(2026, 10, 13)
for a in records:
    flags = []
    if needs_ico(a):
        flags.append("ask ICO")
    if overdue(a, today):
        flags.append("overdue")
    print(a.id, a.system, flags or "ok")

When I run it, I get this:

A1 viewer app ok
A2 voice search ['ask ICO']
A3 subtitle model ['overdue']

The viewer app is fine. The voice search DPIA still has a high risk, so it goes to the ICO. The AI risk assessment for the subtitle model was due on 15 September, so it is late.

It's about thirty lines, and it already answers two questions a privacy team asks every week: what needs the regulator, and what is late?

Where it gets hard

The notice says nothing about how the BBC wants this to work, so this part is my guess.

One system can have a DPIA, a transfer assessment and an AI risk assessment at the same time, and they should point to each other. In my model they can't. The first fix I would try is a links table, so one record can refer to another. After that you need history (who changed what, and when), approvals, and reports that don't take a week to build by hand.

This part is boring to build. It is also the part that lets a privacy team prove an assessment was done, and when.

The notice also gave 2 November 2026 as an estimated date for a real tender. I haven't found one yet, so check before you rely on that date. If a tender does come, I would watch how the platform handles AI risk assessments. That part feels newer and less settled than DPIAs, but that is only my opinion.

If you have built a tool like this, what did you get wrong the first time? And how would you store the links between assessments?