As of 13 August 2026, AI cannot check your business cybersecurity compliance with UK GDPR.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open your current UK GDPR documentation, including security policies, records of processing, processor contracts, risk assessments, incident records, retention rules and staff training records.
   2. Gather current technical evidence from your IT provider or security team, including user and administrator access lists, MFA coverage, patching reports, backup and restore-test records, vulnerability scans, logging settings and incident-response test results.
   3. List every system that handles personal data, its supplier, its location, the data involved, who can access it and whether the supplier acts as a processor.
   4. Paste the evidence and system list into the prompt, keeping document names and page or section references attached to each extract and removing unnecessary personal data.
   5. Ask the AI for the gap-analysis matrix and reject any conclusion marked as supported only by an assumption or a general description rather than evidence.
   6. Send the missing-evidence list and the AI's flagged controls to your DPO, data protection solicitor or qualified cybersecurity professional for testing and an accountable decision.
   7. Record the professional's findings, owners and deadlines in your compliance register, then update the evidence and repeat the review when controls change.

   Prompt

   Act as a UK GDPR compliance analyst, not as a solicitor or certifying auditor. Using only the business information and evidence below, produce a cautious gap-analysis matrix for cybersecurity controls. Do not say that the business is compliant, do not invent facts, and mark every unsupported point as "evidence missing". For each area, provide: the relevant UK GDPR accountability or security theme, the evidence supplied, what the evidence does and does not show, the gap or uncertainty, the risk of relying on the evidence, and a practical next action. Cover access control, authentication and privileged access, patching, malware protection, backups and restoration testing, encryption, logging and monitoring, vulnerability management, incident response and breach reporting, staff training, supplier and processor security, data protection by design, retention and deletion, risk assessments, policies, and records of processing where relevant. Separate documentary evidence from technical evidence and identify controls that need hands-on testing. Cite the source document or page for every conclusion where possible. State which conclusions require checking by a qualified cybersecurity professional or data protection specialist. Finish with a list of evidence still needed and five questions I should answer before any human review.
   
   Business type: [business type]
   Number and type of staff: [staff details]
   Personal data processed: [categories of data]
   Systems and suppliers: [systems, cloud services and processors]
   Relevant policies and records:
   [paste documents or summaries]
   Technical evidence:
   [paste reports, configuration summaries or test results]
   Known incidents or concerns:
   [paste details]
   Assessment date: 2026-08-13

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.