Protect Plus Universal is a modified version of the control set approved by the ICO in the LOCS:23 standard from the same author/scheme owner.

Same controls - simpler audit process.

The core compliance controls remain and others varied to be more relevant to SMEs.

​

​

​

 

The first step is to review the Protect Plus standard and define the processing activities within scope of the certification. This can be all or part of the function of the organisation and can include any use of AI solutions/services.

The organisation then completes a self-assessment questionnaire called a Compliance Statement . Organisations answer a series of questions that confirm compliance with the ICO approved core controls and additional optional controls if appropriate.
 

The core areas covered are:

​

8.1 - Organisation and File Governance

8.2 - Client Rights

8.3 - Operational Privacy

8.4 - Third Party Suppliers & Data Sharing

8.5 - Review & Maintain (optional)

8.6 - AI Governance (optional)

​

The Compliance Statement must be signed-off by either an official Protect Plus Partner or a senior representative of the applicant and the answers are then reviewed by the 224 Certification Team.