As of 13 August 2026, AI cannot act as your business's data protection officer.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the ICO guidance on data protection officers and UK GDPR compliance, and save the relevant pages for comparison.
   2. Gather your current privacy notices, records of processing, processor contracts, retention policy, security policy, DPIAs, breach log, subject access request log and ICO correspondence.
   3. Write a plain-language inventory of the personal data your business handles, who handles it, why it is used, where it is stored, who receives it and whether it leaves the UK.
   4. Remove unnecessary personal data from the documents, paste the inventory and redacted documents into a chatbot, and run the supplied prompt.
   5. Check every cited ICO or GOV.UK source by opening it, mark each conclusion that depends on a missing fact, and compare the action plan with your actual systems and responsibilities.
   6. Send the support pack and unresolved questions to a solicitor or qualified data protection professional, and ask them whether your business needs a formally appointed DPO or another independent privacy function.

   Prompt

   You are assisting with a UK data protection compliance review, not acting as the business's data protection officer. Use the information below to produce a practical DPO support pack for [BUSINESS TYPE AND SIZE]. Apply the UK GDPR and Data Protection Act 2018 where relevant, and distinguish clearly between requirements, good practice and assumptions. Do not invent facts, processing activities, deadlines, legal bases or regulator guidance. Identify every missing fact that could change the conclusion.
   
   Business information:
   [DESCRIBE THE BUSINESS, STAFF, CUSTOMERS, LOCATIONS AND MAIN SERVICES]
   
   Personal data processing:
   [LIST THE CATEGORIES OF PEOPLE, DATA, PURPOSES, SYSTEMS, RECIPIENTS, INTERNATIONAL TRANSFERS, RETENTION AND SECURITY CONTROLS]
   
   Documents and incidents:
   [PASTE OR SUMMARISE RELEVANT POLICIES, PROCESSOR CONTRACTS, PRIVACY NOTICES, DPIAS, DATA BREACHES, SUBJECT ACCESS REQUESTS AND ICO CORRESPONDENCE]
   
   Produce:
   1. A list of the main compliance risks, with the missing evidence for each.
   2. A processing-activities and records-of-processing checklist.
   3. A DPIA triage table showing which processing needs further assessment, without deciding on incomplete facts.
   4. A subject rights and breach-response workflow with the people responsible for each action.
   5. Questions to ask a solicitor or qualified data protection professional.
   6. A prioritised action plan for the next [TIME PERIOD].
   
   For each legal conclusion, cite the relevant ICO or GOV.UK source link if you can verify it. If you cannot verify a source, say so. End by stating why this pack cannot replace an independent, accountable human DPO or specialist adviser.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.