As of 13 August 2026, AI cannot check whether your cold outreach follows UK GDPR.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the campaign brief, CRM and sending tool, then gather the exact message sequence, recipient categories, channels, countries and planned sending dates.
   2. Record how every contact detail was obtained, which enrichment or data suppliers were used, what personal data is stored, and who can access it.
   3. Gather the proposed lawful basis, consent records, opt-out wording, suppression-list process, privacy notice and any supplier contracts or data-processing information.
   4. Open current UK GDPR and electronic marketing guidance from official UK sources, then paste the relevant extracts into the prompt together with the campaign facts.
   5. Run the prompt in a chatbot and ask it to keep unknown facts marked as unknown rather than filling them in.
   6. Give the output and the underlying campaign records to your DPO or a UK data protection solicitor, and do not send the campaign until they resolve the flagged issues.

   Prompt

   Act as a cautious compliance-screening assistant, not as a solicitor. Review the cold outreach plan below against the UK GDPR and the Privacy and Electronic Communications Regulations, using only the facts and current official guidance excerpts I provide. Do not say that the campaign is compliant, lawful or safe. Instead, produce: 1. a table of each relevant issue; 2. the fact needed to assess it; 3. the rule or guidance excerpt that is relevant; 4. what is missing or uncertain; 5. a practical change that would reduce the risk; and 6. a clear list of issues that must be checked by a UK data protection solicitor or suitably qualified data protection professional before sending. Separate UK GDPR data protection points from electronic marketing and consent points. Do not invent a lawful basis, consent, data source, suppression process, privacy notice or recipient category. Flag any conclusion that depends on whether recipients are individuals, sole traders, partnerships or limited companies. State plainly that this is not professional advice.
   
   Campaign details:
   - Sender and business: [describe]
   - Recipients and their business types: [describe]
   - Country or countries of recipients: [describe]
   - Channel: [email, phone, SMS, LinkedIn or other]
   - Message text and follow-up sequence: [paste]
   - How contact details were obtained: [describe]
   - What personal data is used and where it is stored: [describe]
   - Proposed lawful basis: [state or write unknown]
   - Consent and opt-out process: [describe or write none]
   - Privacy notice shown to recipients: [paste or write none]
   - Suppression and do-not-contact process: [describe]
   - Data suppliers or enrichment services: [name or write none]
   - Current official guidance excerpts or links: [paste]
   
   End with the exact facts and documents a professional reviewer would need from me.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.