UK AI Infrastructure Providers: A Data Protection Checklist

Scope of this guide

"AI infrastructure" covers where models run, where data lives and who can reach it. This checklist applies the ICO's guidance to that choice. Every rule quoted below was checked against the regulator's own page on 2 October 2026; check the current version before you rely on it. This is general information, not legal advice.

Accountability and impact assessments

The ICO's AI guidance starts from accountability and governance, including data protection impact assessments. For infrastructure, that means being able to say what personal data the system uses, why, who processes it, and what the risks are, before you sign.

Security and data minimization

The guidance also asks how you assess security and data minimization in AI. Ask a provider what data it needs, what it keeps, for how long, and how it separates your data from other customers'.

Transfers outside the UK

The ICO's three conditions for a restricted transfer are that UK GDPR applies to your processing, that you initiate the transfer to an organization outside the UK, and that the receiver is a separate legal entity. A restricted transfer "must be covered by one of the following transfer mechanisms: UK adequacy regulations; appropriate safeguards; or an exception." Examples of appropriate safeguards are the International Data Transfer Agreement, the International Data Transfer Addendum and UK binding corporate rules, and when you use safeguards you must also complete a transfer risk assessment.

Checklist

• A written description of every location where your data is stored, processed and backed up.
• The names and locations of sub-processors, and how you are told about changes.
• The transfer mechanism for any processing outside the UK, and the transfer risk assessment.
• What is logged, who can read the logs, and how long they are kept.
• How your data is separated from other customers' data.
• Deletion: what is removed, how fast, and how you can verify it.

Where Zunkiree Labs fits

Zunkiree Labs builds custom AI systems (including RAG pipelines, LLM integration and intelligent automation), data systems, custom software, and web and mobile applications, and is based in Nepal. The full list is on the services page. Our own orchestration layer is described plainly: Orca is Zunkiree Labs' intelligence and orchestration layer: it sits above the CRM, email and marketing tools an organization already uses and coordinates agent workflows across them, rather than replacing those tools. Because Zunkiree Labs is based in Nepal, UK personal data handled by it would raise the transfer questions above; ask any provider, including us, to answer the checklist in writing.

Sources

• ICO: Guidance on AI and data protection (last updated 15 March 2023)
• ICO: International transfers, a guide (updated 15 January 2026)