UK AI Cyber Security Code of Practice 10.1: Tell end-users where and how their data is used, accessed and stored

What does 10.1 require?

System operators tell end-users, in a form they can use, where their data goes and how it is used, accessed and stored, including whether it feeds model retraining or is reviewed by employees or partners. An external developer supplies this information to the system operator so it can be passed on.