As of 13 August 2026, AI cannot check whether a supplier meets UK GDPR requirements.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open your supplier onboarding or procurement record and write down the service, the personal data involved, your organisation's role, the supplier's role and every country from which the data may be accessed.
   2. Ask the supplier for its data processing agreement, security information, subprocessor list, international-transfer details, retention and deletion terms, breach process, audit arrangements and answers to your data-protection questionnaire.
   3. Remove unnecessary personal data and paste the supplier documents and written answers into a document-review tool, keeping document names and page numbers intact.
   4. Paste the supplied prompt and ask the tool to produce an evidence table with a status, source, missing evidence and follow-up question for each requirement.
   5. Send the follow-up questions to the supplier and add the dated answers and any replacement documents to the evidence set, without treating an unsupported assertion as proof of a control.
   6. Compare the completed evidence table with your organisation's supplier-risk process and refer unresolved high-risk gaps, unusual international transfers or disputed legal points to a solicitor or qualified data-protection specialist before approval.

   Prompt

   Act as a UK GDPR evidence-review assistant, not a solicitor and not the final decision-maker. Assess the supplier materials below against the requirements relevant to a controller using a processor, including the written processing instructions, confidentiality, security measures, subprocessor controls, assistance with data-subject rights, breach support, deletion or return of data, audit rights, international transfers and records of processing where evidenced. For each point, provide: status as evidenced, partly evidenced, not evidenced or not applicable; the exact source and page or section; what the document actually says; what is missing; and a precise follow-up question for the supplier. Separate documentary evidence from the supplier's unverified assertions. Do not say that the supplier is compliant, certify compliance, invent facts, infer technical controls from marketing language, or give a final legal conclusion. End with a short list of high-risk gaps and the evidence a solicitor or qualified data-protection specialist should review before approval.
   
   Supplier name: [SUPPLIER NAME]
   Services and data processing: [DESCRIBE THE SERVICE AND PERSONAL DATA]
   Your organisation's role: [CONTROLLER, PROCESSOR OR OTHER]
   Countries where data is accessed or stored: [COUNTRIES OR UNKNOWN]
   Supplier documents and answers:
   [PASTE THE MATERIALS HERE]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.