Do not take my word for it

The problem

An education technology deployment that scores pupils on their likelihood of falling behind. Children as data subjects, profiling at scale, inferred health data, and a live automated decision making question.

What I built

Twenty six pages. Nineteen risks scored from the pupil's point of view, thirty five mitigating measures with named owners, and three findings that changed the project: a design feature removed because the Article 9 condition relied on does not exist in Irish law, an Article 22 analysis redone against SCHUFA, and a prior consultation conclusion reversed on review because a controller cannot score a risk High and then define the score away.

The evidence

Written on an invented company so it can be published in full rather than described. Every authority was verified against primary source and the table of authorities ships with it, alongside an Article 35(7) compliance map so a reviewer can check the statutory minimum without reading all of it.

The problem

A companion AI platform used heavily by teenagers removed open ended chat for minors in late 2025, after lawsuits and regulator questions, and introduced age assurance. The open question was whether the new controls actually work.

What I built

A structured evaluation across eight safety dimensions, combining hands on testing with a review of the platform's published safety materials, each dimension judged against a written benchmark and rated on a four point risk scale. The content guardrails largely held. The age gate and the relationship design were the weak points.

The evidence

Testing was done on my own adult account, checking whether safeguards refused rather than trying to defeat them, and stopped at the point of refusal. The method, the benchmarks and the limits of a single structured pass are all written into the document.

The problem

Data subject access requests arriving by email, web form and post, each one starting a statutory clock. Most privacy teams track them in a spreadsheet, which is how a deadline gets missed and how a regulator finds out that it was.

What I built

An intake and tracking workflow that captures the request wherever it lands, logs it against the requester, classifies what is being asked for, sets the statutory deadline, and escalates before the clock runs out rather than after. A deadline monitor runs alongside it. Every step is recorded, so the file evidences itself.

The evidence

The recording below is the workflow running. It matters beyond privacy: a data request and a consumer complaint are the same object structurally. Someone contacts you, it has to be logged, triaged, tracked to a deadline and answered in writing, with a record you can produce later.

The problem

Emailed and PDF documents arriving in an unstructured inbox, each one needing extraction, validation against a reference dataset, and a decision on whether a human had to look at it.

What I built

A working system that reads the document, extracts and validates every line, holds back anything ambiguous with an explanation of exactly what is unclear, and drafts the follow up message. Nothing is written to a system of record and nothing is sent without a person approving it.

The evidence

The recording below is the real system running end to end on two documents, one clean and one deliberately messy. It is not a mockup.

The problem

A compliance programme running on spreadsheets and memory, where evidence of control operation had to be reconstructed after the fact rather than captured as it happened.

What I built

Eight live modules covering intake, routing, inventory, continuous monitoring and escalation, plus six end to end workflows with deadline tracking and an AI triage step that classifies inbound requests, routes by urgency and drafts a first response. A person approves at every decision point.

The evidence

Control operation is now evidenced as it happens. Available to walk through live on a call.