Updated October 2026
EchoDepth governance framework
EchoDepth by Cavefish is governed by a documented framework covering consent, purpose limitation, data subject rights and UK GDPR compliance. Every enterprise deployment is covered by a signed Data Processing Agreement, and outputs are evidence for human review rather than automated decisions about individuals.
Cavefish builds governance into every EchoDepth deployment: consent architecture, purpose limitation, data minimisation and audit trails as standard.
Purpose Limitation
Every EchoDepth deployment is scoped to a defined analytical purpose. Data is processed only for that purpose - not retained, repurposed or shared.
Consent Architecture
Explicit, informed consent is required from all data subjects before any analysis. Consent frameworks are deployment-specific, documented and auditable.
Data Subject Rights
EchoDepth deployments include documented mechanisms for data subjects to exercise their rights under UK GDPR - access, rectification, erasure and portability.
Third-Party Audit
Enterprise deployments can include third-party audit provisions. Cavefish supports full transparency in governance documentation and process review.
Equality Act Alignment
EchoDepth outputs are designed to augment human judgement - not replace it - particularly in sensitive HR, recruitment and assessment contexts.
Common questions
Is EchoDepth GDPR compliant?
Yes. Cavefish is ICO registered (ZB915633) and EchoDepth is designed for UK GDPR compliance from the ground up. All enterprise deployments include a signed Data Processing Agreement, explicit consent architecture, and purpose limitation enforced at DPA level. Data subjects retain full rights to access, rectification, erasure and portability.
Does EchoDepth require a DPIA?
For most enterprise deployments involving video or voice analysis of identifiable individuals, a DPIA is recommended and in some cases required under UK GDPR Article 35. Cavefish provides structured DPIA support documentation for all enterprise clients, covering the processing activity, lawful basis, risk assessment and mitigations.
What data does EchoDepth retain after analysis?
EchoDepth does not retain raw biometric data after the analysis window closes. Processed outputs - Trust Scores, Credibility Signal timelines, coaching notes - are retained only as specified in the Data Processing Agreement. On-premise deployment is available for organisations requiring zero data egress.
What lawful basis does EchoDepth use for processing?
EchoDepth deployments operate under the lawful basis most appropriate to the specific processing context. Explicit consent (Article 6(1)(a) + Article 9(2)(a)) is used for all platform deployments involving identifiable individuals - including player welfare monitoring and workforce applications. Legitimate interests (Article 6(1)(f)) applies to analysis of public figures acting in their professional public capacity, such as pre-match press conference analysis, where a documented Legitimate Interests Assessment and DPIA are on file. The appropriate basis for each deployment is confirmed in the Data Processing Agreement.
Does EchoDepth comply with the Equality Act 2010?
Yes. EchoDepth is designed to augment human judgement — not replace it — particularly in HR, recruitment and assessment contexts. All outputs are presented as evidence to support qualified decision-makers, never as automated determinations. This aligns with Equality Act 2010 requirements in regulated deployment contexts.
How EchoDepth governance works in practice
Every EchoDepth enterprise deployment operates under a documented governance framework. This is not a policy document - it is an architecture requirement. The governance framework is enforced at the DPA level, not the preference level.
What EchoDepth does not do - equally important
Is EchoDepth compliant with UK GDPR?
Yes. Cavefish is ICO registered (ZB915633), and EchoDepth is designed for UK GDPR compliance from the ground up. Every enterprise deployment runs under a signed Data Processing Agreement, which sets the purpose limitation, retention, sub-processor obligations and data subject rights. Each deployment has a lawful basis documented for its use case, either explicit consent or legitimate interests, and explicit informed consent is required from all data subjects before any analysis. Data subjects have documented mechanisms to exercise rights of access, rectification, erasure and portability. Raw biometric data is not retained after the analysis window closes, and processing takes place in UK or EU data centres. Cavefish provides structured DPIA support documentation, and outputs are evidence for human review, never automated decisions about individuals. Data minimisation and audit trails are built in as standard. Enterprise deployments can include third-party audit provisions. On-premise deployment is available for organisations requiring zero data egress.