Storage · /home/box/agents/fyj-founder-bot/directory/market-path-research-2026-09-01-2255.md

Market-path research — 1 Sep 2026 22:55 Europe/London

Not a P move. No path named. No customer named.
Did not re-read Companies House company 16892858.
Did not repeat last recon hour: Bank of England Credit Conditions Survey / www.bankofengland.co.uk/credit-conditions-survey/2026/2026-q2 (1 Sep 21:55 Market discovery).
Also did not repeat as primary: Crisis / crisis.org.uk / www.crisis.org.uk (1 Sep 20:55 Competitor mapping); Santander Breakthrough / www.santander.co.uk/breakthrough (1 Sep 19:55 Market scenarios); DBT / GOV.UK Longitudinal Small Business Survey (LSBS) 2024 (1 Sep 18:55 Market discovery); Shelter / england.shelter.org.uk / www.shelter.org.uk (1 Sep 17:55 Competitor mapping); SyndicateRoom / www.syndicateroom.com (1 Sep 16:55 Companies in the space); Youth Access / youthaccess.org.uk (1 Sep 15:55 Competitor mapping); GEM UK / Global Entrepreneurship Monitor UK / gemconsortium.org (1 Sep 13:55 Market discovery); Google for Startups / startup.google.com (1 Sep 12:55 Market scenarios); Consumer Rights Act 2015 / CRA 2015 (1 Sep 11:55 Risk reduction); Seedrs / www.seedrs.com / europe.republic.com (1 Sep 10:55 Companies in the space); Advicelocal / advicelocal.uk (1 Sep 09:55 Competitor mapping); Crowdcube / www.crowdcube.com (1 Sep 07:55 Companies in the space); GOV.UK Business Support Helpline (1 Sep 06:55 Market scenarios); IPSE (1 Sep 05:55 Companies in the space); CCR 2013 (1 Sep 04:55 Risk reduction); Access to Justice Foundation / ATJF / atjf.org.uk (1 Sep 03:55 Competitor mapping); Virgin StartUp (1 Sep 02:55 Market scenarios); Founders Forum / ff.co (1 Sep 01:55 Companies in the space); AdviceNow / www.advicenow.org.uk (1 Sep 00:55 Competitor mapping); Barclays Eagle Labs (31 Aug 23:55 Market scenarios); The Entrepreneurs Network / TEN (31 Aug 22:55 Companies in the space); RCJ Advice (31 Aug 21:55 Competitor mapping); JUSTICE (31 Aug 19:55 Competitor mapping); Centre for Entrepreneurs / CFE (31 Aug 20:55 Companies in the space); CBI (31 Aug 17:55 Companies in the space); NatWest Accelerator (31 Aug 18:55 Market scenarios); British Library BIPC (31 Aug 16:55 Market scenarios); National Pro Bono Centre (31 Aug 15:55 Competitor mapping); techUK (31 Aug 13:55 Companies in the space); The King's Trust (31 Aug 12:55 Market scenarios); Free Representation Unit (31 Aug 11:55 Competitor mapping); PECR (31 Aug 10:55 Risk reduction); Innovate Finance (31 Aug 09:55 Companies in the space); Support Through Court (31 Aug 07:55 Competitor mapping); BVCA / UK Private Capital (31 Aug 06:55 Companies in the space); Advocate (31 Aug 05:55 Competitor mapping); MentorsMe (31 Aug 03:55 Market scenarios); Equality Act 2010 (31 Aug 02:55 Risk reduction); UKBAA (31 Aug 01:55); AdviceUK (31 Aug 00:55); ScaleUp Institute (30 Aug 23:55); Law Centres Network (30 Aug 22:55); Be the Business (30 Aug 21:55); Enterprise Nation (30 Aug 20:55); LawWorks (30 Aug 19:55); ACAS (30 Aug 18:55); Citizens Advice (30 Aug 17:55); Growth Hub (30 Aug 16:55); Legal Choices (30 Aug 15:55); ICO data protection fee (28 Aug 21:55). Explicitly did not re-open BoE CCS / Crisis / Shelter / Santander Breakthrough / Lloyds Bank Lab / HSBC Kinetic / LSBS / GEM UK / Google for Startups / CRA 2015 / Seedrs / Advicelocal / Crowdcube / Helpline / IPSE / CCR 2013 / ATJF / Virgin StartUp / Founders Forum / AdviceNow / Eagle Labs / TEN / CFE / CBI / techUK / Innovate Finance / BVCA / UKBAA / ScaleUp / Be the Business / Enterprise Nation / BCC / IoD / FSB / RCJ Advice / JUSTICE / NPBC / FRU / Support Through Court / Advocate / AdviceUK / Law Centres / LawWorks / Citizens Advice / Legal Choices as primary. Also did not use as a separate primary this hour: Funding Circle; ONS labour-market overview; unpublished ONS UK business activity, size and location 2026 (provisional 24 Sep 2026) — GDPR / DPA 2018 primary cluster lives. Distinct from 14:20 compile (e834b2f2, 0 candidates, blocker reach) and from 15:36 reach-story/stats (58cd58c1). Distinct from ICO data-protection fee (28 Aug 21:55), PECR (31 Aug 10:55), CRA 2015 (1 Sep 11:55), CCR 2013 (1 Sep 04:55). 08:55 direction window closed at 10:25 with no reply — logged as skipped; this hour does not re-ask. 14:55 did not fire this cycle — not re-asked this hour. 17:15 close already ran at 17:32 — this hour does not re-close the cycle. Did not unpark/install customer cut 63e813ea. Did not write kpis/p-evidence.md. Did not promote Ironclad, Harvey, Legora, SOC 2, or “startups and SMEs” as an accepted market/path. Did not install the 12:48 productised hour-menu as a path. Did not treat data subjects, controllers, processors, ICO, “startups and SMEs”, small organisations, or GOV.UK data-protection readers as a FYJ customer. Did not invent a Companies House number for the ICO. Did not re-read 16892858. Did not invent a live unpublished ONS 2026 size bulletin.

Area: Risk reduction.
Verdict: stronger as a constraint on invention only; stayed thin as a path.
P unchanged.

Searched

Prefer Risk reduction this hour — UK GDPR / Data Protection Act 2018 (legislation.gov.uk + ICO guidance — NEW; distinct from ICO data-protection fee 28 Aug 21:55, PECR 31 Aug 10:55, CRA 2015 1 Sep 11:55, CCR 2013 1 Sep 04:55) — named unused Risk-reduction fallback on 1 Sep 21:55 BoE CCS. Why this source now: destination $2.5–5bn; first-customer cut parked (63e813ea); live gate still cannot compile path candidates (e834b2f2 compile 0; blocker still REACH — how a first professional hour is found and sold); last recon hour was CCS market discovery, and 21:55 named UK GDPR as unused risk-reduction fallback — a public data-protection code can be read without inventing a buyer. Hold = no invention, not no recon. Not a FYJ path. Not P. This hour works a constraint on the live compile-paths gate, not the reach blocker itself, and does not invent a buyer to close it. Rotate category away from Market discovery — primary GDPR cluster lives. Fallbacks not switched to: Funding Circle; ONS labour-market overview.

HTTP inventory

Contents https://www.legislation.gov.uk/ukpga/2018/12/contents — Shell curl first-hop HTTP 200 content-type text/html;charset=utf-8; GET body size 642489 text/html;charset=utf-8. Title: Data Protection Act 2018. Printed: up to date with all changes known to be in force on or before 28 August 2026 this hour. TOC printed PART 1 Preliminary (ss.1–3); PART 2 General processing (CHAPTER 1 Scope and definitions; CHAPTER 2 The UK GDPR; CHAPTER 3 exemptions for manual unstructured processing and national security and defence); PART 3 Law enforcement processing; PART 4 Intelligence services processing; PART 5 The Information Commissioner; PART 6 Enforcement; PART 7 Supplementary and final provision; Schedules including Schedule 1 special-category / criminal-convictions conditions and Schedule 2 exemptions etc from the UK GDPR. Last-Modified header Thu, 27 Aug 2026 16:10:40 GMT. WebFetch confirmed the same contents body.
Act apex https://www.legislation.gov.uk/ukpga/2018/12 — first-hop HTTP 200; GET body size 4939634 text/html;charset=utf-8. Title: Data Protection Act 2018. Existence; whole Act not dumped onto Founder View.
Introduction https://www.legislation.gov.uk/ukpga/2018/12/introduction — HTTP 200 size 43877. Printed 2018 CHAPTER 12; long title: An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice. Contents-page in-force line on this page printed 29 August 2026 this hour (contents page printed 28 August 2026 — recorded as printed, not reconciled into one invented date).
Contents as enacted https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted — HTTP 200 size 409462. Title: Data Protection Act 2018. Original (as enacted) TOC; not treated as the revised text.
Explanatory Notes https://www.legislation.gov.uk/ukpga/2018/12/notes/contents — first-hop HTTP 301 Location http://www.legislation.gov.uk/ukpga/2018/12/notes/division/1/index.htm; follow HTTP 200 size 23335 text/html; charset=UTF-8. Title: Data Protection Act 2018. Notes lander, not a second Act body.
Part 1 Preliminary https://www.legislation.gov.uk/ukpga/2018/12/part/1 — HTTP 200 size 91863.
Part 2 General processing https://www.legislation.gov.uk/ukpga/2018/12/part/2 — HTTP 200 size 410390.
Part 2 Chapter 2 The UK GDPR https://www.legislation.gov.uk/ukpga/2018/12/part/2/chapter/2 — HTTP 200 size 237093.
Part 5 The Information Commissioner https://www.legislation.gov.uk/ukpga/2018/12/part/5 — HTTP 200 size 305590.
Schedule 1 https://www.legislation.gov.uk/ukpga/2018/12/schedule/1 — HTTP 200 size 211651 (special-category / criminal-convictions conditions — existence; schedule text not dumped onto Founder View).
Schedule 2 https://www.legislation.gov.uk/ukpga/2018/12/schedule/2 — HTTP 200 size 288157 (exemptions etc from the UK GDPR — existence).
Section pages (TOC titles as printed; each Shell curl HTTP 200 this hour): s.1 Overview (48238) — this Act makes provision about the processing of personal data; most processing of personal data is subject to the UK GDPR; Part 2 supplements the UK GDPR; Part 3 law-enforcement processing; Part 4 intelligence-services processing; s.2 Protection of personal data (43817) — the UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by requiring personal data to be processed lawfully and fairly, on the basis of the data subject’s consent or another specified basis, and conferring rights on the data subject; s.3 Terms relating to the processing of personal data (76330) — “Personal data” means any information relating to an identified or identifiable living individual; s.4 Processing to which this Part applies (46484); s.6 Meaning of “controller” (47322); s.8 Lawfulness of processing: public interest etc (44925); s.9 Child’s consent in relation to information society services (41406); s.10 Special categories of personal data and criminal convictions etc data (52487); s.114 The Information Commissioner (40140) — there is to continue to be an Information Commissioner; Commencement Information I1 S. 114 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e); s.115 General functions under the UK GDPR and safeguards (74369); s.157 Maximum amount of penalty (59644) — existence; amounts not dumped onto Founder View; s.212 Commencement (42233) — Commencement Information I1 S. 212 in force at Royal Assent, see s. 212(2).
King’s Printer PDF https://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180012_en.pdf — first-hop HTTP 200 content-type application/pdf; GET body size 3059697 application/pdf. Noted size/type only; statute extract not dumped onto Founder View. Named /ukpga/2018/12/data.pdf first-hop HTTP 202 size 0 this hour — not treated as a second PDF cluster.
Retained UK GDPR contents https://www.legislation.gov.uk/eur/2016/679/contents — HTTP 200 size 95206. Title starts: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation).
Retained UK GDPR apex https://www.legislation.gov.uk/eur/2016/679 — HTTP 200 size 1487090. Existence; whole regulation not dumped onto Founder View.
Article 4 Definitions https://www.legislation.gov.uk/eur/2016/679/article/4 — HTTP 200 size 90090. Printed: up to date with all changes known to be in force on or before 30 August 2026 this hour.
Article 5 Principles https://www.legislation.gov.uk/eur/2016/679/article/5 — HTTP 200 size 46275. Printed: up to date with all changes known to be in force on or before 27 August 2026 this hour. GOV.UK /data-protection restates the live principles in plain English (fairly, lawfully and transparently; specified, explicit purposes; adequate, relevant and limited; accurate; kept no longer than necessary; appropriate security) — used as the founder-readable restatement; Article 5 HTML not dumped onto Founder View.
Article 6 Lawfulness of processing https://www.legislation.gov.uk/eur/2016/679/article/6 — HTTP 200 size 69527. Printed: up to date with all changes known to be in force on or before 30 August 2026 this hour. WebFetch confirmed Art. 6(1): processing lawful only if at least one of (a) consent; (b) contract; (c) legal obligation; (d) vital interests; (e) public task / official authority; (ea) recognised legitimate interest; (f) legitimate interests, except where overridden by the data subject’s interests or fundamental rights, in particular where the data subject is a child. Point (ea) inserted by Data (Use and Access) Act 2025 ss.70, in force for these purposes 5.2.2026 (S.I. 2026/82).
Named legislation short paths HTTP 404 GET body size 12293 title Legislation.gov.uk: /ukpga/2018/12/uk-gdpr ; /ukpga/2018/12/gdpr ; /ukgdpr ; /eur/2016/679/chapter/1. Named 404s are not a live “UK GDPR Act” page.
Commencement SI contents https://www.legislation.gov.uk/uksi/2018/625/contents — HTTP 200 size 26004. Title: The Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018.
Commencement SI reg. 2 https://www.legislation.gov.uk/uksi/2018/625/regulation/2 — HTTP 200. Printed: provisions coming into force on 25th May 2018 so far as not already in force (see section 212(2)).
http://www.legislation.gov.uk/ukpga/2018/12/contents — first-hop HTTP 301 → https://www.legislation.gov.uk/ukpga/2018/12/contents; follow HTTP 200 size 642489.
https://legislation.gov.uk/ukpga/2018/12/contents — first-hop HTTP 301 → https://www.legislation.gov.uk:443/ukpga/2018/12/contents; follow HTTP 200 size 642489.
ICO UK GDPR hub https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/ — first-hop HTTP 200 content-type text/html; charset=utf-8; GET body size 49509. Title: UK GDPR guidance and resources | ICO. h1: UK GDPR guidance and resources. Shell HTML this hour is a live 200 with the hub title; card body is thin in static HTML (JS). WebFetch returned title-only on the hub. Not invented into a missing page — lawful-basis / individual-rights / personal-information / controllers-and-processors pages below carry the printed guidance.
Old ICO GDPR-guide path https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ — first-hop HTTP 301 Location /for-organisations/uk-gdpr-guidance-and-resources/; follow HTTP 200 size 49509 same hub.
Alias https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ — first-hop HTTP 301 → same hub HTTP 200 size 49509.
Lawful basis https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/ — HTTP 200 size 42811. Title: Lawful basis | ICO. WebFetch confirmed: guidance on the seven reasons you can use for using personal information (known as lawful basis); listed Consent; Recognised legitimate interest; Legitimate interests; Special category data; Criminal offence data; Biometric recognition. Small businesses pointed at the small-organisations section — not treated as a FYJ customer.
Individual rights https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/ — HTTP 200 size 40656. Title: Individual rights - guidance and resources | ICO. Printed brief guidance covering privacy notices, subject access requests, deleting and changing information, stopping and restricting processing, moving information and making automated decisions; detailed: right to be informed; right of access (SARs); automated decision-making and profiling.
Personal information https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/ — HTTP 200 size 41614. Title: Personal information - what is it? | ICO. Printed: due to changes made by the Data (Use and Access) Act, this guidance is under review; who the UK GDPR applies to; what personal information is.
Controllers and processors https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/ — HTTP 200 size 39934. Title: Controllers and processors | ICO. Printed: definitions of controllers and processors; how to determine the role; joint controllers; controller / processor self-assessments. Controllers and processors are legal roles, not a FYJ customer.
Accountability and governance https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/ — HTTP 200 size 40928. Title: Accountability and governance | ICO. Printed: contracts, documentation, data protection by design and default, DPIAs, data protection officers.
Legislation we cover https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/ — HTTP 200 size 39590. Title: Legislation we cover | ICO. Printed: The Data (Use and Access) Act amends, but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR). Our role is to uphold information rights in the public interest.
For organisations https://ico.org.uk/for-organisations/ — HTTP 200 size 38764. Title: For organisations | ICO.
ICO guide-to-data-protection https://ico.org.uk/for-organisations/guide-to-data-protection/ — first-hop HTTP 301 → /for-organisations/; follow HTTP 200 size 38764.
ICO home https://ico.org.uk/ — HTTP 200 size 53141. Title: Information Commissioner’s Office.
Who we are https://ico.org.uk/about-the-ico/who-we-are/ — HTTP 200 size 38269. Title: Who we are | ICO. Printed (static + WebFetch): The ICO exists to empower you through information. Find out more about our organisation and structure. No UK company number printed this hour. CH not opened; none invented. Did not re-read 16892858.
What we do https://ico.org.uk/about-the-ico/what-we-do/ — HTTP 200 size 53486. Title: What we do | ICO.
Advice for small and medium organisations https://ico.org.uk/for-organisations/advice-for-small-organisations/ — HTTP 200 size 50150. Title: Advice for small and medium organisations | ICO. Printed: advice for small-to-medium-sized enterprises, start-ups, sole traders, small charities, groups and clubs. Alias https://ico.org.uk/for-organisations/sme-web-hub/ HTTP 200 size 50112 same title. “Start-ups” / SMEs here are an ICO guidance audience, not a FYJ customer.
Distinct ICO fee (not used as primary): https://ico.org.uk/for-organisations/data-protection-fee/ — HTTP 200 size 49432 title Data protection fee | ICO. Already filed 28 Aug 21:55. Existence only this hour — not re-filed as primary. Named /for-organisations/data-protection-fee/self-assessment/ HTTP 404 size 29132.
www.ico.org.uk hub — first-hop HTTP 301 → https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/; follow HTTP 200 size 49509.
http://ico.org.uk hub — first-hop HTTP 301 → https same path; follow HTTP 200 size 49509.
Named ICO short paths HTTP 404 size ~29032–29140 title Page not found | ICO: /gdpr ; /uk-gdpr ; /for-organisations/advice-and-services/small-organisations/ ; /for-organisations/sme/ ; /for-organisations/make-a-data-protection-complaint/.
GOV.UK data-protection hub https://www.gov.uk/data-protection — HTTP 200 size 81194. Title: Data protection: The UK’s data protection legislation - GOV.UK. WebFetch confirmed: in the UK, data protection is governed by the UK GDPR and the Data Protection Act 2018; anyone responsible for using personal data must follow data-protection principles unless an exemption applies; rights include be informed, access, have incorrect data updated, erasure, stop or restrict processing, data portability, object, plus rights around automated decision-making and profiling; ICO as the complaint / advice desk. Printed contact: ICO Telephone 0303 123 1113; Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. No company number printed.
GOV.UK data protection and your business https://www.gov.uk/data-protection-your-business — HTTP 200 size 83072. Title: Data protection and your business: Overview - GOV.UK. Printed: you must follow rules on data protection if your business stores or uses personal information (staff, customers, account holders; recruit; manage staff records; market products or services; CCTV); keep information secure, accurate and up to date; tell people who you are and how you’ll use their information; rights to see / correct / request deletion / request data is not used for certain purposes; tell the ICO how your business uses personal information; respond to a data-protection request; you could be given a heavy fine or made to pay compensation if you misuse personal data. Direct-marketing pointer is the PECR lane already filed 31 Aug 10:55 — noted as sibling, not re-filed as primary.
GOV.UK DPA 2018 collection https://www.gov.uk/government/collections/data-protection-act-2018 — HTTP 200 size 73664. Title: Data Protection Act 2018 - GOV.UK. Printed: The Data Protection Act updates our data protection laws for the digital age. It received Royal Assent on 23 May 2018. From: Department for Science, Innovation and Technology, Home Office and Department for Digital, Culture, Media & Sport (2017 to 2023). Published 23 May 2018. Last updated 19 August 2020.
GOV.UK ICO organisation https://www.gov.uk/government/organisations/information-commissioner-s-office — HTTP 200 size 71753. Title: Information Commissioner’s Office - GOV.UK. Named hyphenless /government/organisations/informationcommissioners-office HTTP 404 size 52434.
Named GOV.UK short paths HTTP 404 size 52434 title Page not found - GOV.UK: /gdpr ; /uk-gdpr ; /guidance/uk-gdpr ; /guidance/data-protection-act-2018 ; /guidance/data-protection ; /data-protection-act ; /data-protection-act-2018 ; /government/publications/data-protection-act-2018 ; /ico ; /data-protection-fee ; /pay-data-protection-fee.
Named GOV.UK GDPR-guide publication https://www.gov.uk/government/publications/guide-to-the-general-data-protection-regulation — first-hop HTTP 410; follow HTTP 410 size 52568. Title: The page you’re looking for is no longer here - GOV.UK. Recorded as gone; not invented into a live ICO-guide mirror.

Did not invent a FYJ buyer from data subjects, controllers, processors, ICO, “startups and SMEs”, small organisations, or GOV.UK data-protection readers. Named 404 / 410 / 202 paths are not a live UK-GDPR Act page or a second PDF. ICO fee already filed 28 Aug 21:55 — existence only. Funding Circle / ONS labour-market / unpublished ONS 2026 were not switched to — GDPR primary cluster lives.

What stands

Live GDPR / DPA 2018 cluster: legislation.gov.uk contents HTTP 200 size 642489 + apex HTTP 200 size 4939634 + introduction / parts 1–2 / part 2 chapter 2 / part 5 / schedules 1–2 / named sections above (HTTP 200) + King’s Printer PDF HTTP 200 size 3059697 application/pdf + retained UK GDPR eur/2016/679 contents / apex / arts 4–6 HTTP 200 + S.I. 2018/625 contents HTTP 200 size 26004. ICO UK GDPR hub / lawful-basis / individual-rights / personal-information / controllers-and-processors / accountability / legislation-we-cover HTTP 200. GOV.UK /data-protection /data-protection-your-business /government/collections/data-protection-act-2018 /government/organisations/information-commissioner-s-office HTTP 200. Named GOV.UK /gdpr and guidance short paths HTTP 404. Named legislation /ukgdpr HTTP 404. data.pdf HTTP 202 size 0. ICO /gdpr HTTP 404.
Data Protection Act 2018 (c.12). Royal Assent 23 May 2018 (GOV.UK collection). s.212 in force at Royal Assent. Main remaining provisions in force 25 May 2018 (S.I. 2018/625). Contents up to date with changes known on or before 28 August 2026 this hour. s.1: this Act makes provision about the processing of personal data; most processing is subject to the UK GDPR; Part 2 supplements it. s.2: personal data must be processed lawfully and fairly, on the data subject’s consent or another specified basis, with rights conferred on the data subject. s.3: personal data = any information relating to an identified or identifiable living individual. s.114: there is to continue to be an Information Commissioner (in force 25.5.2018). UK GDPR Art. 6(1) lawful bases this hour: consent; contract; legal obligation; vital interests; public task; recognised legitimate interest (ea; DUAA from 5.2.2026); legitimate interests. ICO: seven reasons (lawful basis). GOV.UK: ICO as the UK regulator / complaint desk; Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; tel 0303 123 1113. DUAA amends but does not replace UK GDPR, DPA 2018, PECR (ICO legislation-we-cover). Distinct from 28 Aug 21:55 ICO fee, 31 Aug 10:55 PECR, 1 Sep 11:55 CRA, 1 Sep 04:55 CCR 2013.
Risk-reduction constraint on inventing a formation / professional-services / client-data / CRM / legal-tech / first-hour-sold-with-personal-data path without noticing UK GDPR + DPA 2018. Sits on processing personal data — not a buyer. Not a FYJ market path.

What does not stand

No page names a FYJ customer, market, offer, or P.
Data subjects, controllers, processors, ICO, “startups and SMEs”, and ICO small-organisation readers are legal classes / guidance audiences, not a buyer.
A data-protection code is not a FYJ market path.
Naming “FYJ for startups and SMEs / clients whose personal data we process / ICO-regulated SMEs” is inventing a customer — banned. Collision with founder-context.md: do not mint “startups and SMEs” as who; do not put Ironclad/Harvey on the map; productised-menu is a model not a path.
Do not invent a live /ukgdpr Act page from named 404s. Do not invent a second PDF from data.pdf HTTP 202 size 0. Do not invent a GOV.UK /gdpr hub from 404/410. Do not dump the whole Act or PDF onto Founder View. Do not stitch ICO fee / PECR / CRA / CCR into this hour as if re-read. Do not re-file CCS as primary.
ICO fee (28 Aug 21:55), PECR (31 Aug 10:55), CRA 2015 (1 Sep 11:55), CCR 2013 (1 Sep 04:55), Equality Act, HSWA, CA 2006, Bribery Act s.7, CFA, FTPF, LSA remain prior Risk reduction. CCS (21:55) remains prior Market discovery. This hour does not re-file those pages.
Who / why / how / next all missing. No candidate this hour has even a partial who / why / how. End-to-end stays missing. Productised-menu context from 12:48 does not fill those blanks. Compile stays 0 (e834b2f2); reach blocker not closed by filing the data-protection code. Stronger as a constraint; stayed thin as a path.

End-to-end test

Who it is for: missing.
Why they would pay: missing.
How FYJ reaches them: missing (a public data-protection constraint is not how FYJ reaches a named buyer).
What sits next: missing.
No real public fact this hour filled any of the four. Do not invent the rest. The GDPR / DPA 2018 live pages fill a Risk reduction cell (constraint on inventing a formation / professional-services / client-data / CRM / legal-tech / first-hour-sold-with-personal-data path). They do not fill a path cell. They do not install the productised-menu bucket. They do not pad compile candidates. Compile stays 0.

Value-forming

The Risk reduction line got stronger as a constraint on invention only. Value has not started to form as a FYJ path. Lawful basis / personal data / ICO-as-regulator / data-subject rights are not a path. Adjacent Risk reduction filings (CRA 2015; CCR 2013; PECR; ICO fee; Equality Act; HSWA; CA 2006; Bribery; CFA; FTPF) still leave who / why / how / next empty.

Result

No path named yet. Risk reduction stronger as a constraint; stayed thin as a path. P unchanged. GDPR primary cluster lives — no switch.

Unused fallbacks named for NEXT hour

Companies in the space: Funding Circle (fundingcircle.com — SME lending / how-founders-meet-debt capital; distinct from Crowdcube / Seedrs / SyndicateRoom / BBB / Start Up Loans).
If that dead: Market discovery — ONS labour-market overview. Do not fake unpublished ONS UK business activity, size and location 2026 (provisional 24 Sep 2026). Do not re-read CCS Q2 as primary. Do not re-read GDPR / DPA 2018 as primary.
Do not re-use BoE CCS / Crisis / Shelter / Santander Breakthrough / Lloyds Bank Lab / HSBC Kinetic / LSBS / GEM UK / Google for Startups / Youth Access / SyndicateRoom / Advicelocal / Seedrs / Crowdcube / CRA 2015 / UK GDPR / DPA 2018 as primary next hour.

Confirmation

Contract UUID 26e4abb6-3b66-4a66-a4f7-d4c065ad9233 is live. Hold = no invention, not no recon. Standing work is recon until end-to-end paths emerge and value-forming is visible. No path named. P unchanged. Customer cut parked.
One line: 63e813ea is live (parked).
e834b2f2 compile still 0; blocker still reach. 58cd58c1 Founder View is the story. 06657cd0 pages shareable. f7c2a04e voice walk. c7b2e14a short Evidence. Hermes parked. Slot unchanged. Layer unchanged (Peer toggle: Founder View ↔ Agent View).
08:55 skipped (no reply by 10:25). Proceeded without new founder input. 14:55 did not fire this cycle — not re-asked this hour. 17:15 close already ran at 17:32 — not re-closed this hour.

# Market-path research — 1 Sep 2026 22:55 Europe/London Not a P move. No path named. No customer named. Did not re-read Companies House company 16892858. Did not repeat last recon hour: Bank of England Credit Conditions Survey / www.bankofengland.co.uk/credit-conditions-survey/2026/2026-q2 (1 Sep 21:55 Market discovery). Also did not repeat as primary: Crisis / crisis.org.uk / www.crisis.org.uk (1 Sep 20:55 Competitor mapping); Santander Breakthrough / www.santander.co.uk/breakthrough (1 Sep 19:55 Market scenarios); DBT / GOV.UK Longitudinal Small Business Survey (LSBS) 2024 (1 Sep 18:55 Market discovery); Shelter / england.shelter.org.uk / www.shelter.org.uk (1 Sep 17:55 Competitor mapping); SyndicateRoom / www.syndicateroom.com (1 Sep 16:55 Companies in the space); Youth Access / youthaccess.org.uk (1 Sep 15:55 Competitor mapping); GEM UK / Global Entrepreneurship Monitor UK / gemconsortium.org (1 Sep 13:55 Market discovery); Google for Startups / startup.google.com (1 Sep 12:55 Market scenarios); Consumer Rights Act 2015 / CRA 2015 (1 Sep 11:55 Risk reduction); Seedrs / www.seedrs.com / europe.republic.com (1 Sep 10:55 Companies in the space); Advicelocal / advicelocal.uk (1 Sep 09:55 Competitor mapping); Crowdcube / www.crowdcube.com (1 Sep 07:55 Companies in the space); GOV.UK Business Support Helpline (1 Sep 06:55 Market scenarios); IPSE (1 Sep 05:55 Companies in the space); CCR 2013 (1 Sep 04:55 Risk reduction); Access to Justice Foundation / ATJF / atjf.org.uk (1 Sep 03:55 Competitor mapping); Virgin StartUp (1 Sep 02:55 Market scenarios); Founders Forum / ff.co (1 Sep 01:55 Companies in the space); AdviceNow / www.advicenow.org.uk (1 Sep 00:55 Competitor mapping); Barclays Eagle Labs (31 Aug 23:55 Market scenarios); The Entrepreneurs Network / TEN (31 Aug 22:55 Companies in the space); RCJ Advice (31 Aug 21:55 Competitor mapping); JUSTICE (31 Aug 19:55 Competitor mapping); Centre for Entrepreneurs / CFE (31 Aug 20:55 Companies in the space); CBI (31 Aug 17:55 Companies in the space); NatWest Accelerator (31 Aug 18:55 Market scenarios); British Library BIPC (31 Aug 16:55 Market scenarios); National Pro Bono Centre (31 Aug 15:55 Competitor mapping); techUK (31 Aug 13:55 Companies in the space); The King's Trust (31 Aug 12:55 Market scenarios); Free Representation Unit (31 Aug 11:55 Competitor mapping); PECR (31 Aug 10:55 Risk reduction); Innovate Finance (31 Aug 09:55 Companies in the space); Support Through Court (31 Aug 07:55 Competitor mapping); BVCA / UK Private Capital (31 Aug 06:55 Companies in the space); Advocate (31 Aug 05:55 Competitor mapping); MentorsMe (31 Aug 03:55 Market scenarios); Equality Act 2010 (31 Aug 02:55 Risk reduction); UKBAA (31 Aug 01:55); AdviceUK (31 Aug 00:55); ScaleUp Institute (30 Aug 23:55); Law Centres Network (30 Aug 22:55); Be the Business (30 Aug 21:55); Enterprise Nation (30 Aug 20:55); LawWorks (30 Aug 19:55); ACAS (30 Aug 18:55); Citizens Advice (30 Aug 17:55); Growth Hub (30 Aug 16:55); Legal Choices (30 Aug 15:55); ICO data protection fee (28 Aug 21:55). Explicitly did not re-open BoE CCS / Crisis / Shelter / Santander Breakthrough / Lloyds Bank Lab / HSBC Kinetic / LSBS / GEM UK / Google for Startups / CRA 2015 / Seedrs / Advicelocal / Crowdcube / Helpline / IPSE / CCR 2013 / ATJF / Virgin StartUp / Founders Forum / AdviceNow / Eagle Labs / TEN / CFE / CBI / techUK / Innovate Finance / BVCA / UKBAA / ScaleUp / Be the Business / Enterprise Nation / BCC / IoD / FSB / RCJ Advice / JUSTICE / NPBC / FRU / Support Through Court / Advocate / AdviceUK / Law Centres / LawWorks / Citizens Advice / Legal Choices as primary. Also did not use as a separate primary this hour: Funding Circle; ONS labour-market overview; unpublished ONS UK business activity, size and location 2026 (provisional 24 Sep 2026) — GDPR / DPA 2018 primary cluster lives. Distinct from 14:20 compile (e834b2f2, 0 candidates, blocker reach) and from 15:36 reach-story/stats (58cd58c1). Distinct from ICO data-protection fee (28 Aug 21:55), PECR (31 Aug 10:55), CRA 2015 (1 Sep 11:55), CCR 2013 (1 Sep 04:55). 08:55 direction window closed at 10:25 with no reply — logged as skipped; this hour does not re-ask. 14:55 did not fire this cycle — not re-asked this hour. 17:15 close already ran at 17:32 — this hour does not re-close the cycle. Did not unpark/install customer cut 63e813ea. Did not write kpis/p-evidence.md. Did not promote Ironclad, Harvey, Legora, SOC 2, or “startups and SMEs” as an accepted market/path. Did not install the 12:48 productised hour-menu as a path. Did not treat data subjects, controllers, processors, ICO, “startups and SMEs”, small organisations, or GOV.UK data-protection readers as a FYJ customer. Did not invent a Companies House number for the ICO. Did not re-read 16892858. Did not invent a live unpublished ONS 2026 size bulletin. Area: Risk reduction. Verdict: stronger as a constraint on invention only; stayed thin as a path. P unchanged. ## Searched Prefer Risk reduction this hour — UK GDPR / Data Protection Act 2018 (legislation.gov.uk + ICO guidance — NEW; distinct from ICO data-protection fee 28 Aug 21:55, PECR 31 Aug 10:55, CRA 2015 1 Sep 11:55, CCR 2013 1 Sep 04:55) — named unused Risk-reduction fallback on 1 Sep 21:55 BoE CCS. Why this source now: destination $2.5–5bn; first-customer cut parked (63e813ea); live gate still cannot compile path candidates (e834b2f2 compile 0; blocker still REACH — how a first professional hour is found and sold); last recon hour was CCS market discovery, and 21:55 named UK GDPR as unused risk-reduction fallback — a public data-protection code can be read without inventing a buyer. Hold = no invention, not no recon. Not a FYJ path. Not P. This hour works a constraint on the live compile-paths gate, not the reach blocker itself, and does not invent a buyer to close it. Rotate category away from Market discovery — primary GDPR cluster lives. Fallbacks not switched to: Funding Circle; ONS labour-market overview. ## HTTP inventory - Contents https://www.legislation.gov.uk/ukpga/2018/12/contents — Shell curl first-hop HTTP 200 content-type text/html;charset=utf-8; GET body size 642489 text/html;charset=utf-8. Title: Data Protection Act 2018. Printed: up to date with all changes known to be in force on or before 28 August 2026 this hour. TOC printed PART 1 Preliminary (ss.1–3); PART 2 General processing (CHAPTER 1 Scope and definitions; CHAPTER 2 The UK GDPR; CHAPTER 3 exemptions for manual unstructured processing and national security and defence); PART 3 Law enforcement processing; PART 4 Intelligence services processing; PART 5 The Information Commissioner; PART 6 Enforcement; PART 7 Supplementary and final provision; Schedules including Schedule 1 special-category / criminal-convictions conditions and Schedule 2 exemptions etc from the UK GDPR. Last-Modified header Thu, 27 Aug 2026 16:10:40 GMT. WebFetch confirmed the same contents body. - Act apex https://www.legislation.gov.uk/ukpga/2018/12 — first-hop HTTP 200; GET body size 4939634 text/html;charset=utf-8. Title: Data Protection Act 2018. Existence; whole Act not dumped onto Founder View. - Introduction https://www.legislation.gov.uk/ukpga/2018/12/introduction — HTTP 200 size 43877. Printed 2018 CHAPTER 12; long title: An Act to make provision for the regulation of the processing of information relating to individuals; to make provision in connection with the Information Commissioner’s functions under certain regulations relating to information; to make provision for a direct marketing code of practice. Contents-page in-force line on this page printed 29 August 2026 this hour (contents page printed 28 August 2026 — recorded as printed, not reconciled into one invented date). - Contents as enacted https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted — HTTP 200 size 409462. Title: Data Protection Act 2018. Original (as enacted) TOC; not treated as the revised text. - Explanatory Notes https://www.legislation.gov.uk/ukpga/2018/12/notes/contents — first-hop HTTP 301 Location http://www.legislation.gov.uk/ukpga/2018/12/notes/division/1/index.htm; follow HTTP 200 size 23335 text/html; charset=UTF-8. Title: Data Protection Act 2018. Notes lander, not a second Act body. - Part 1 Preliminary https://www.legislation.gov.uk/ukpga/2018/12/part/1 — HTTP 200 size 91863. - Part 2 General processing https://www.legislation.gov.uk/ukpga/2018/12/part/2 — HTTP 200 size 410390. - Part 2 Chapter 2 The UK GDPR https://www.legislation.gov.uk/ukpga/2018/12/part/2/chapter/2 — HTTP 200 size 237093. - Part 5 The Information Commissioner https://www.legislation.gov.uk/ukpga/2018/12/part/5 — HTTP 200 size 305590. - Schedule 1 https://www.legislation.gov.uk/ukpga/2018/12/schedule/1 — HTTP 200 size 211651 (special-category / criminal-convictions conditions — existence; schedule text not dumped onto Founder View). - Schedule 2 https://www.legislation.gov.uk/ukpga/2018/12/schedule/2 — HTTP 200 size 288157 (exemptions etc from the UK GDPR — existence). - Section pages (TOC titles as printed; each Shell curl HTTP 200 this hour): s.1 Overview (48238) — this Act makes provision about the processing of personal data; most processing of personal data is subject to the UK GDPR; Part 2 supplements the UK GDPR; Part 3 law-enforcement processing; Part 4 intelligence-services processing; s.2 Protection of personal data (43817) — the UK GDPR and this Act protect individuals with regard to the processing of personal data, in particular by requiring personal data to be processed lawfully and fairly, on the basis of the data subject’s consent or another specified basis, and conferring rights on the data subject; s.3 Terms relating to the processing of personal data (76330) — “Personal data” means any information relating to an identified or identifiable living individual; s.4 Processing to which this Part applies (46484); s.6 Meaning of “controller” (47322); s.8 Lawfulness of processing: public interest etc (44925); s.9 Child’s consent in relation to information society services (41406); s.10 Special categories of personal data and criminal convictions etc data (52487); s.114 The Information Commissioner (40140) — there is to continue to be an Information Commissioner; Commencement Information I1 S. 114 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(e); s.115 General functions under the UK GDPR and safeguards (74369); s.157 Maximum amount of penalty (59644) — existence; amounts not dumped onto Founder View; s.212 Commencement (42233) — Commencement Information I1 S. 212 in force at Royal Assent, see s. 212(2). - King’s Printer PDF https://www.legislation.gov.uk/ukpga/2018/12/pdfs/ukpga_20180012_en.pdf — first-hop HTTP 200 content-type application/pdf; GET body size 3059697 application/pdf. Noted size/type only; statute extract not dumped onto Founder View. Named /ukpga/2018/12/data.pdf first-hop HTTP 202 size 0 this hour — not treated as a second PDF cluster. - Retained UK GDPR contents https://www.legislation.gov.uk/eur/2016/679/contents — HTTP 200 size 95206. Title starts: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation). - Retained UK GDPR apex https://www.legislation.gov.uk/eur/2016/679 — HTTP 200 size 1487090. Existence; whole regulation not dumped onto Founder View. - Article 4 Definitions https://www.legislation.gov.uk/eur/2016/679/article/4 — HTTP 200 size 90090. Printed: up to date with all changes known to be in force on or before 30 August 2026 this hour. - Article 5 Principles https://www.legislation.gov.uk/eur/2016/679/article/5 — HTTP 200 size 46275. Printed: up to date with all changes known to be in force on or before 27 August 2026 this hour. GOV.UK /data-protection restates the live principles in plain English (fairly, lawfully and transparently; specified, explicit purposes; adequate, relevant and limited; accurate; kept no longer than necessary; appropriate security) — used as the founder-readable restatement; Article 5 HTML not dumped onto Founder View. - Article 6 Lawfulness of processing https://www.legislation.gov.uk/eur/2016/679/article/6 — HTTP 200 size 69527. Printed: up to date with all changes known to be in force on or before 30 August 2026 this hour. WebFetch confirmed Art. 6(1): processing lawful only if at least one of (a) consent; (b) contract; (c) legal obligation; (d) vital interests; (e) public task / official authority; (ea) recognised legitimate interest; (f) legitimate interests, except where overridden by the data subject’s interests or fundamental rights, in particular where the data subject is a child. Point (ea) inserted by Data (Use and Access) Act 2025 ss.70, in force for these purposes 5.2.2026 (S.I. 2026/82). - Named legislation short paths HTTP 404 GET body size 12293 title Legislation.gov.uk: /ukpga/2018/12/uk-gdpr ; /ukpga/2018/12/gdpr ; /ukgdpr ; /eur/2016/679/chapter/1. Named 404s are not a live “UK GDPR Act” page. - Commencement SI contents https://www.legislation.gov.uk/uksi/2018/625/contents — HTTP 200 size 26004. Title: The Data Protection Act 2018 (Commencement No. 1 and Transitional and Saving Provisions) Regulations 2018. - Commencement SI reg. 2 https://www.legislation.gov.uk/uksi/2018/625/regulation/2 — HTTP 200. Printed: provisions coming into force on 25th May 2018 so far as not already in force (see section 212(2)). - http://www.legislation.gov.uk/ukpga/2018/12/contents — first-hop HTTP 301 → https://www.legislation.gov.uk/ukpga/2018/12/contents; follow HTTP 200 size 642489. - https://legislation.gov.uk/ukpga/2018/12/contents — first-hop HTTP 301 → https://www.legislation.gov.uk:443/ukpga/2018/12/contents; follow HTTP 200 size 642489. - ICO UK GDPR hub https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/ — first-hop HTTP 200 content-type text/html; charset=utf-8; GET body size 49509. Title: UK GDPR guidance and resources | ICO. h1: UK GDPR guidance and resources. Shell HTML this hour is a live 200 with the hub title; card body is thin in static HTML (JS). WebFetch returned title-only on the hub. Not invented into a missing page — lawful-basis / individual-rights / personal-information / controllers-and-processors pages below carry the printed guidance. - Old ICO GDPR-guide path https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ — first-hop HTTP 301 Location /for-organisations/uk-gdpr-guidance-and-resources/; follow HTTP 200 size 49509 same hub. - Alias https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/ — first-hop HTTP 301 → same hub HTTP 200 size 49509. - Lawful basis https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/ — HTTP 200 size 42811. Title: Lawful basis | ICO. WebFetch confirmed: guidance on the seven reasons you can use for using personal information (known as lawful basis); listed Consent; Recognised legitimate interest; Legitimate interests; Special category data; Criminal offence data; Biometric recognition. Small businesses pointed at the small-organisations section — not treated as a FYJ customer. - Individual rights https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/ — HTTP 200 size 40656. Title: Individual rights - guidance and resources | ICO. Printed brief guidance covering privacy notices, subject access requests, deleting and changing information, stopping and restricting processing, moving information and making automated decisions; detailed: right to be informed; right of access (SARs); automated decision-making and profiling. - Personal information https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/personal-information-what-is-it/ — HTTP 200 size 41614. Title: Personal information - what is it? | ICO. Printed: due to changes made by the Data (Use and Access) Act, this guidance is under review; who the UK GDPR applies to; what personal information is. - Controllers and processors https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/ — HTTP 200 size 39934. Title: Controllers and processors | ICO. Printed: definitions of controllers and processors; how to determine the role; joint controllers; controller / processor self-assessments. Controllers and processors are legal roles, not a FYJ customer. - Accountability and governance https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/ — HTTP 200 size 40928. Title: Accountability and governance | ICO. Printed: contracts, documentation, data protection by design and default, DPIAs, data protection officers. - Legislation we cover https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/ — HTTP 200 size 39590. Title: Legislation we cover | ICO. Printed: The Data (Use and Access) Act amends, but does not replace, the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and the Privacy and Electronic Communications Regulations (PECR). Our role is to uphold information rights in the public interest. - For organisations https://ico.org.uk/for-organisations/ — HTTP 200 size 38764. Title: For organisations | ICO. - ICO guide-to-data-protection https://ico.org.uk/for-organisations/guide-to-data-protection/ — first-hop HTTP 301 → /for-organisations/; follow HTTP 200 size 38764. - ICO home https://ico.org.uk/ — HTTP 200 size 53141. Title: Information Commissioner’s Office. - Who we are https://ico.org.uk/about-the-ico/who-we-are/ — HTTP 200 size 38269. Title: Who we are | ICO. Printed (static + WebFetch): The ICO exists to empower you through information. Find out more about our organisation and structure. No UK company number printed this hour. CH not opened; none invented. Did not re-read 16892858. - What we do https://ico.org.uk/about-the-ico/what-we-do/ — HTTP 200 size 53486. Title: What we do | ICO. - Advice for small and medium organisations https://ico.org.uk/for-organisations/advice-for-small-organisations/ — HTTP 200 size 50150. Title: Advice for small and medium organisations | ICO. Printed: advice for small-to-medium-sized enterprises, start-ups, sole traders, small charities, groups and clubs. Alias https://ico.org.uk/for-organisations/sme-web-hub/ HTTP 200 size 50112 same title. “Start-ups” / SMEs here are an ICO guidance audience, not a FYJ customer. - Distinct ICO fee (not used as primary): https://ico.org.uk/for-organisations/data-protection-fee/ — HTTP 200 size 49432 title Data protection fee | ICO. Already filed 28 Aug 21:55. Existence only this hour — not re-filed as primary. Named /for-organisations/data-protection-fee/self-assessment/ HTTP 404 size 29132. - www.ico.org.uk hub — first-hop HTTP 301 → https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/; follow HTTP 200 size 49509. - http://ico.org.uk hub — first-hop HTTP 301 → https same path; follow HTTP 200 size 49509. - Named ICO short paths HTTP 404 size ~29032–29140 title Page not found | ICO: /gdpr ; /uk-gdpr ; /for-organisations/advice-and-services/small-organisations/ ; /for-organisations/sme/ ; /for-organisations/make-a-data-protection-complaint/. - GOV.UK data-protection hub https://www.gov.uk/data-protection — HTTP 200 size 81194. Title: Data protection: The UK’s data protection legislation - GOV.UK. WebFetch confirmed: in the UK, data protection is governed by the UK GDPR and the Data Protection Act 2018; anyone responsible for using personal data must follow data-protection principles unless an exemption applies; rights include be informed, access, have incorrect data updated, erasure, stop or restrict processing, data portability, object, plus rights around automated decision-making and profiling; ICO as the complaint / advice desk. Printed contact: ICO Telephone 0303 123 1113; Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. No company number printed. - GOV.UK data protection and your business https://www.gov.uk/data-protection-your-business — HTTP 200 size 83072. Title: Data protection and your business: Overview - GOV.UK. Printed: you must follow rules on data protection if your business stores or uses personal information (staff, customers, account holders; recruit; manage staff records; market products or services; CCTV); keep information secure, accurate and up to date; tell people who you are and how you’ll use their information; rights to see / correct / request deletion / request data is not used for certain purposes; tell the ICO how your business uses personal information; respond to a data-protection request; you could be given a heavy fine or made to pay compensation if you misuse personal data. Direct-marketing pointer is the PECR lane already filed 31 Aug 10:55 — noted as sibling, not re-filed as primary. - GOV.UK DPA 2018 collection https://www.gov.uk/government/collections/data-protection-act-2018 — HTTP 200 size 73664. Title: Data Protection Act 2018 - GOV.UK. Printed: The Data Protection Act updates our data protection laws for the digital age. It received Royal Assent on 23 May 2018. From: Department for Science, Innovation and Technology, Home Office and Department for Digital, Culture, Media & Sport (2017 to 2023). Published 23 May 2018. Last updated 19 August 2020. - GOV.UK ICO organisation https://www.gov.uk/government/organisations/information-commissioner-s-office — HTTP 200 size 71753. Title: Information Commissioner’s Office - GOV.UK. Named hyphenless /government/organisations/informationcommissioners-office HTTP 404 size 52434. - Named GOV.UK short paths HTTP 404 size 52434 title Page not found - GOV.UK: /gdpr ; /uk-gdpr ; /guidance/uk-gdpr ; /guidance/data-protection-act-2018 ; /guidance/data-protection ; /data-protection-act ; /data-protection-act-2018 ; /government/publications/data-protection-act-2018 ; /ico ; /data-protection-fee ; /pay-data-protection-fee. - Named GOV.UK GDPR-guide publication https://www.gov.uk/government/publications/guide-to-the-general-data-protection-regulation — first-hop HTTP 410; follow HTTP 410 size 52568. Title: The page you’re looking for is no longer here - GOV.UK. Recorded as gone; not invented into a live ICO-guide mirror. Did not invent a FYJ buyer from data subjects, controllers, processors, ICO, “startups and SMEs”, small organisations, or GOV.UK data-protection readers. Named 404 / 410 / 202 paths are not a live UK-GDPR Act page or a second PDF. ICO fee already filed 28 Aug 21:55 — existence only. Funding Circle / ONS labour-market / unpublished ONS 2026 were not switched to — GDPR primary cluster lives. ## What stands - Live GDPR / DPA 2018 cluster: legislation.gov.uk contents HTTP 200 size 642489 + apex HTTP 200 size 4939634 + introduction / parts 1–2 / part 2 chapter 2 / part 5 / schedules 1–2 / named sections above (HTTP 200) + King’s Printer PDF HTTP 200 size 3059697 application/pdf + retained UK GDPR eur/2016/679 contents / apex / arts 4–6 HTTP 200 + S.I. 2018/625 contents HTTP 200 size 26004. ICO UK GDPR hub / lawful-basis / individual-rights / personal-information / controllers-and-processors / accountability / legislation-we-cover HTTP 200. GOV.UK /data-protection /data-protection-your-business /government/collections/data-protection-act-2018 /government/organisations/information-commissioner-s-office HTTP 200. Named GOV.UK /gdpr and guidance short paths HTTP 404. Named legislation /ukgdpr HTTP 404. data.pdf HTTP 202 size 0. ICO /gdpr HTTP 404. - Data Protection Act 2018 (c.12). Royal Assent 23 May 2018 (GOV.UK collection). s.212 in force at Royal Assent. Main remaining provisions in force 25 May 2018 (S.I. 2018/625). Contents up to date with changes known on or before 28 August 2026 this hour. s.1: this Act makes provision about the processing of personal data; most processing is subject to the UK GDPR; Part 2 supplements it. s.2: personal data must be processed lawfully and fairly, on the data subject’s consent or another specified basis, with rights conferred on the data subject. s.3: personal data = any information relating to an identified or identifiable living individual. s.114: there is to continue to be an Information Commissioner (in force 25.5.2018). UK GDPR Art. 6(1) lawful bases this hour: consent; contract; legal obligation; vital interests; public task; recognised legitimate interest (ea; DUAA from 5.2.2026); legitimate interests. ICO: seven reasons (lawful basis). GOV.UK: ICO as the UK regulator / complaint desk; Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; tel 0303 123 1113. DUAA amends but does not replace UK GDPR, DPA 2018, PECR (ICO legislation-we-cover). Distinct from 28 Aug 21:55 ICO fee, 31 Aug 10:55 PECR, 1 Sep 11:55 CRA, 1 Sep 04:55 CCR 2013. - Risk-reduction constraint on inventing a formation / professional-services / client-data / CRM / legal-tech / first-hour-sold-with-personal-data path without noticing UK GDPR + DPA 2018. Sits on processing personal data — not a buyer. Not a FYJ market path. ## What does not stand - No page names a FYJ customer, market, offer, or P. - Data subjects, controllers, processors, ICO, “startups and SMEs”, and ICO small-organisation readers are legal classes / guidance audiences, not a buyer. - A data-protection code is not a FYJ market path. - Naming “FYJ for startups and SMEs / clients whose personal data we process / ICO-regulated SMEs” is inventing a customer — banned. Collision with founder-context.md: do not mint “startups and SMEs” as who; do not put Ironclad/Harvey on the map; productised-menu is a model not a path. - Do not invent a live /ukgdpr Act page from named 404s. Do not invent a second PDF from data.pdf HTTP 202 size 0. Do not invent a GOV.UK /gdpr hub from 404/410. Do not dump the whole Act or PDF onto Founder View. Do not stitch ICO fee / PECR / CRA / CCR into this hour as if re-read. Do not re-file CCS as primary. - ICO fee (28 Aug 21:55), PECR (31 Aug 10:55), CRA 2015 (1 Sep 11:55), CCR 2013 (1 Sep 04:55), Equality Act, HSWA, CA 2006, Bribery Act s.7, CFA, FTPF, LSA remain prior Risk reduction. CCS (21:55) remains prior Market discovery. This hour does not re-file those pages. - Who / why / how / next all missing. No candidate this hour has even a partial who / why / how. End-to-end stays missing. Productised-menu context from 12:48 does not fill those blanks. Compile stays 0 (e834b2f2); reach blocker not closed by filing the data-protection code. Stronger as a constraint; stayed thin as a path. ## End-to-end test - Who it is for: missing. - Why they would pay: missing. - How FYJ reaches them: missing (a public data-protection constraint is not how FYJ reaches a named buyer). - What sits next: missing. No real public fact this hour filled any of the four. Do not invent the rest. The GDPR / DPA 2018 live pages fill a Risk reduction cell (constraint on inventing a formation / professional-services / client-data / CRM / legal-tech / first-hour-sold-with-personal-data path). They do not fill a path cell. They do not install the productised-menu bucket. They do not pad compile candidates. Compile stays 0. ## Value-forming The Risk reduction line got stronger as a constraint on invention only. Value has not started to form as a FYJ path. Lawful basis / personal data / ICO-as-regulator / data-subject rights are not a path. Adjacent Risk reduction filings (CRA 2015; CCR 2013; PECR; ICO fee; Equality Act; HSWA; CA 2006; Bribery; CFA; FTPF) still leave who / why / how / next empty. ## Result No path named yet. Risk reduction stronger as a constraint; stayed thin as a path. P unchanged. GDPR primary cluster lives — no switch. ## Unused fallbacks named for NEXT hour 1. Companies in the space: Funding Circle (fundingcircle.com — SME lending / how-founders-meet-debt capital; distinct from Crowdcube / Seedrs / SyndicateRoom / BBB / Start Up Loans). 2. If that dead: Market discovery — ONS labour-market overview. Do not fake unpublished ONS UK business activity, size and location 2026 (provisional 24 Sep 2026). Do not re-read CCS Q2 as primary. Do not re-read GDPR / DPA 2018 as primary. 3. Do not re-use BoE CCS / Crisis / Shelter / Santander Breakthrough / Lloyds Bank Lab / HSBC Kinetic / LSBS / GEM UK / Google for Startups / Youth Access / SyndicateRoom / Advicelocal / Seedrs / Crowdcube / CRA 2015 / UK GDPR / DPA 2018 as primary next hour. ## Confirmation Contract UUID 26e4abb6-3b66-4a66-a4f7-d4c065ad9233 is live. Hold = no invention, not no recon. Standing work is recon until end-to-end paths emerge and value-forming is visible. No path named. P unchanged. Customer cut parked. One line: 63e813ea is live (parked). e834b2f2 compile still 0; blocker still reach. 58cd58c1 Founder View is the story. 06657cd0 pages shareable. f7c2a04e voice walk. c7b2e14a short Evidence. Hermes parked. Slot unchanged. Layer unchanged (Peer toggle: Founder View ↔ Agent View). 08:55 skipped (no reply by 10:25). Proceeded without new founder input. 14:55 did not fire this cycle — not re-asked this hour. 17:15 close already ran at 17:32 — not re-closed this hour.