Audit artefacts
When ODPC asks
“prove it stayed here,”
open the folder.
Outside legal advice, a structured evidence pack: architecture diagrams, log samples, residency attestations, and templates your counsel can adapt.
Architecture pack
Network diagrams showing inference, storage, and backup paths, Kenya-labelled, no hand-wavy “cloud.”
Log exemplars
Redacted samples of prompt audit trails, access controls, and retention settings your SIEM can ingest.
DPIA templates
Pre-filled sections for AI processing purposes, lawful basis placeholders, and transfer assessments.
Eval records
Links to red-team outputs and go-live gates, proof you tested before production.
odpc-evidence-pack/ ├── 01-architecture.pdf ├── 02-data-flows.kdpa.docx ├── 03-residency-attestation.pdf ├── 04-log-retention-spec.md ├── 05-eval-summary-redacted.pdf └── 06-counsel-checklist.pdf
Kenyan DPOs inherit AI systems built by engineering in a hurry. When registration or a sector exam lands, “we use a private model” falls short of a document. The ODPC evidence pack is the folder structure that turns your Corvux deployment into artefacts counsel can defend, alongside our KDPA pillar.
FAQ
DPO and external counsel.
Does this satisfy ODPC by itself?
No legal guarantee. It gives your DPO structured technical evidence to support registrations, DPIAs, and regulator responses.
What if we are on managed AI vs appliance?
Pack templates cover both, with fields for hosting location, subprocessors, and data flows you control.
Who signs attestations?
Corvux attests to what we operate; your DPO attests to organisational processing, roles are clearly separated.
How often to refresh?
After major architecture changes, new agents, or model swaps. Annual refresh minimum for regulated sectors.
Order an evidence pack
Available post-deployment or bundled with appliance / managed go-live. Counsel intro call optional.
Request pack scope