Why these DPIAs exist: The ICO requires a DPIA where processing involves (a) systematic and extensive profiling or automated decision-making, (b) large-scale processing of special category data, or (c) innovative use of new technologies. Mintstone's use of AI for transaction classification and document analysis, combined with Open Banking financial data, meets threshold (c). These DPIAs were completed before any customer data was processed.
DPIA 1: Open Banking Transaction Processing
Mintstone retrieves bank transactions from borrowers' accounts via TrueLayer (FCA-authorised Open Banking provider) to verify drawdown expenditure, monitor construction costs against budgets, and check loan covenant compliance. Transactions are automatically classified into spend categories using OpenAI's API (zero-retention) to match them against JCT budget line items.
- Data collected: Account holder name, sort code, account number, IBAN, transaction descriptions, amounts, dates, running balances
- Processing applied: AI-assisted spend classification (mappedCategory, aiMatchConfidence, aiMatchReason), budget variance analysis, drawdown verification
- Data subjects: Property developers (borrowers) and bank account holders connected to monitored projects
- Volume: Typically 1–50 bank accounts per lender, refreshed via Open Banking every 24 hours during active monitoring
- Retention: 7 years from transaction date (REGULATORY_7Y)
Lawful basis: Article 6(1)(b) Contract (necessary for loan monitoring service) and Article 6(1)(c) Legal obligation (regulatory record-keeping).
- Necessity: Lenders are contractually required to monitor how borrowers spend loan funds. Open Banking provides real-time, verified transaction data directly from the bank — replacing manual PDF statement uploads which are slower, less reliable, and can be manipulated
- Proportionality: Only accounts explicitly connected by the lender are monitored. TrueLayer consent expires after 90 days, requiring active re-consent. Only transaction data is retrieved — no access to other banking products, credit cards, or savings
- Data minimisation: Transaction descriptions are sent to OpenAI for classification only — no account holder names or account numbers are included in AI API calls
- Purpose limitation: Data is used solely for loan monitoring and regulatory compliance — never for credit scoring, marketing, or sharing with third parties
| Risk | Likelihood | Severity | Overall | Mitigation |
|---|---|---|---|---|
| Unauthorised access to bank transaction data | Low | High | Medium | RBAC, AES-256 encryption at rest, TLS 1.3 in transit, MFA for admin access, SHA-256 audit trail |
| Data breach at sub-processor (TrueLayer, OpenAI) | Low | High | Medium | TrueLayer is FCA-authorised with regulated security standards; OpenAI zero-retention API (data not stored); DPAs with both; breach notification clauses ≤ 48 hours |
| AI misclassification leads to incorrect covenant assessment | Medium | Medium | Medium | All AI outputs presented to human users for review; confidence scores displayed; manual override available; no autonomous decisions |
| Excessive data collection beyond monitoring purpose | Low | Medium | Low | Only transaction data retrieved (no other banking products); account numbers excluded from AI API calls; 90-day consent expiry |
| Borrower unaware of transaction monitoring | Low | Medium | Low | Open Banking consent flow is explicit and FCA-regulated; monitoring disclosed in facility agreement; privacy notice provided to borrower by lender |
| International transfer risk (OpenAI — US) | Low | Medium | Low | Zero-retention API (data not persisted in US); EU SCCs in place; only transaction descriptions transferred (no PII); OpenAI DPA in place |
- Consent management: TrueLayer consent tokens expire after 90 days — automatic re-consent required; consent status tracked in database (consentToken, consentStatus, consentExpiresAt)
- Data minimisation for AI: Only transaction description text sent to OpenAI — account holder PII excluded from API calls
- Human review: All AI classifications displayed with confidence scores; lender users review and can override any classification
- Encryption: AES-256 at rest (AWS RDS eu-west-2); TLS 1.3 in transit; TrueLayer consent tokens encrypted in database
- Access control: RBAC with project-level scoping; bank data visible only to authorised lender users assigned to that project
- Audit trail: SHA-256 hash-chained immutable log of all access to and changes in bank transaction data
- Retention enforcement: Automated REGULATORY_7Y retention category; deletion logged in audit trail
- Sub-processor controls: DPAs with TrueLayer and OpenAI; breach notification ≤ 48 hours; annual sub-processor review
✅ DPIA Outcome
Residual risk is acceptable. The combination of FCA-regulated Open Banking consent, zero-retention AI processing, data minimisation, human review of all outputs, and robust encryption/access controls reduces risk to a level that does not require consultation with the ICO under Article 36. Processing may proceed.
DPIA 2: AI Document Analysis & OCR
Mintstone uses AI services (OpenAI, Anthropic) to extract and analyse structured data from construction documents uploaded by lender staff and contractors. Anthropic Claude handles primary OCR and invoice extraction; OpenAI GPT-4o provides fallback OCR and Vision-based text extraction. This includes invoices, QS reports, professional certificates, valuations, and site photographs.
- Data collected: Uploaded document contents including names, company details, signatures, invoice amounts, certifications; site photographs which may incidentally capture individuals
- Processing applied: OCR text extraction, AI-powered data structuring, anomaly detection, budget line item matching, certificate verification
- Data subjects: Property developers, contractors, subcontractors, professional advisors (surveyors, QS, architects), individuals incidentally captured in site photographs
- Volume: Typically 10–200 documents per project, uploaded throughout the loan lifecycle
- Retention: 7 years from upload date (REGULATORY_7Y)
Lawful basis: Article 6(1)(b) Contract (necessary for loan monitoring) and Article 6(1)(f) Legitimate interests (efficient document processing — see LIA).
- Necessity: ADC loan monitoring requires analysis of hundreds of construction documents per project. Manual extraction is too slow for continuous monitoring and prone to human error in financial calculations
- Proportionality: AI processing is applied only to documents voluntarily uploaded for the purpose of loan monitoring. Only relevant document sections are sent to AI processors — full documents are not transmitted in their entirety where it is practical to segment
- Data minimisation: AI outputs extract only structured data fields needed for monitoring (amounts, dates, names, categories). Raw document content is not stored by AI sub-processors (zero-retention agreements)
- Site photographs: Photos may incidentally capture individuals on construction sites. These images are processed for construction progress assessment only — no facial recognition, biometric analysis, or individual identification is performed
| Risk | Likelihood | Severity | Overall | Mitigation |
|---|---|---|---|---|
| Unauthorised access to uploaded documents containing personal data | Low | High | Medium | S3 server-side encryption (AES-256); pre-signed URLs with time-limited access; RBAC; file type validation via magic-byte inspection and size limits; audit logging |
| AI sub-processor data breach (OpenAI, Anthropic) | Low | High | Medium | Both sub-processors operate under zero-retention agreements (no customer data stored or used for training); DPAs and EU SCCs in place with each; breach notification clauses |
| AI hallucination produces incorrect data extraction | Medium | Medium | Medium | All AI outputs presented to human users for review and correction; confidence indicators where available; manual override for all extracted fields; original document always available for comparison |
| Incidental processing of individuals in site photographs | Medium | Low | Low | Photos processed for construction progress only; no facial recognition or biometric processing; non-essential EXIF metadata stripped before storage (GPS+timestamp retained for verification); access restricted via RBAC |
| International transfer of document content to US-based AI processors | Medium | Medium | Medium | Zero-retention API agreements (data not persisted in US); EU SCCs with all processors; data minimisation (relevant sections only); DPAs in place |
| Contractor personal data (bank details, qualifications) exposed beyond intended purpose | Low | Medium | Low | Extracted data visible only to authorised lender users on that project; RBAC; no data shared externally; contractor bank details used only for transaction matching |
- Zero-retention AI: Both AI sub-processors (OpenAI, Anthropic) operate under zero-retention agreements — customer data is not stored, logged, or used for model training
- Data minimisation: Where practical, only relevant sections of documents are sent to AI processors rather than entire files
- Human review: All AI-extracted data is presented to lender users for review before any monitoring decision is influenced by it
- Document storage: Original documents stored in AWS S3 eu-west-2 with AES-256 server-side encryption; access via pre-signed URLs with configurable time limits
- Access control: RBAC ensures documents are visible only to users authorised on the specific project; no cross-project document access
- Photo safeguards: GPS coordinates and timestamps extracted from EXIF for site verification, then non-essential metadata (camera model, lens, device serial) stripped via
sharpbefore S3 storage (Article 5(1)(c) data minimisation) - Upload security: File type validation via magic-byte header inspection (prevents disguised-extension attacks); MIME type allowlisting; maximum file size limits (10–25 MB per context)
- Audit trail: All document uploads, AI processing events, and human review actions logged in SHA-256 hash-chained immutable audit log
- Sub-processor governance: DPAs with all AI sub-processors; annual review of sub-processor security posture; breach notification ≤ 48 hours
- Retention: Automated REGULATORY_7Y retention enforcement; secure deletion via S3 lifecycle policies and database cascade purge
✅ DPIA Outcome
Residual risk is acceptable. The combination of zero-retention AI processing, data minimisation, mandatory human review of all outputs, encrypted storage, RBAC, and comprehensive audit logging reduces risk to a level that does not require consultation with the ICO under Article 36. Processing may proceed.
Related documents: Privacy Policy · Retention Schedule · Legitimate Interests Assessments · Data Processing Agreement · Trust & Security