As of 13 August 2026, AI can check whether your UK business needs a data protection officer.

What to actually do

1. Hand it to a person

   The route this page recommends

   A person who owns the outcome does this end to end, worth it when the failure is dear.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Open the current ICO guidance on data protection officers and keep the sections on when a DPO is required beside your notes.
   2. Gather your records on core services, categories of personal data, people affected, monitoring or profiling, geographical scope, processing frequency and any special category or criminal-offence data.
   3. Paste the prompt into a chatbot and replace each bracketed slot with your business facts, marking anything unknown as unknown rather than guessing.
   4. Answer the chatbot's follow-up questions using your processing records, privacy information, data maps and supplier details.
   5. Compare the result's reasoning with the current ICO criteria, checking each statement about public authorities, core activities, regular and systematic monitoring and large-scale processing.
   6. Record the conclusion, assumptions and evidence in your compliance file, and send the file to a UK data protection solicitor or specialist if the result is unclear or the processing is substantial or sensitive.

   Prompt

   Assess whether my UK business is required to appoint a data protection officer under the UK GDPR. This is a preliminary compliance check, not a final legal determination.
   
   Use only the facts I provide. Do not invent facts, assume that our processing is large scale, or treat ordinary business monitoring as systematic monitoring without explaining why. Separate confirmed facts, assumptions and missing information.
   
   First, ask me for any missing facts needed to assess these points:
   1. Whether we are a public authority or body, excluding courts acting in their judicial capacity.
   2. Whether our core activities involve processing operations that require regular and systematic monitoring of individuals on a large scale.
   3. Whether our core activities involve large-scale processing of special category data or personal data relating to criminal convictions and offences.
   4. What personal data we process, the purposes, the number and type of people affected, the geographical area, how often the processing occurs and whether the processing is core to our business.
   5. Whether any other UK or sector-specific rule may require a DPO or a similar role.
   
   Then provide:
   - a result of likely required, likely not required or unclear;
   - a short analysis against each relevant UK GDPR criterion;
   - the facts that led to each conclusion;
   - the uncertainties that could change the result;
   - the practical next steps, including whether to check current ICO guidance or ask a UK data protection solicitor or specialist;
   - a list of records I should keep to show how the decision was reached.
   
   Do not state that a DPO is required merely because we process personal data, use CCTV, have employees, or handle special category data on a small scale. Do not give a definitive legal opinion. Use current ICO guidance only if I paste it or provide a source for you to inspect, and flag anything that needs checking against the current ICO wording.
   
   Business facts:
   [Business type and whether it is a public authority]
   [Core products or services]
   [Personal data processed]
   [People affected and approximate scale]
   [Purposes and lawful purposes of processing]
   [Monitoring, profiling, tracking or surveillance activities]
   [Whether special category or criminal-offence data is processed, and at what scale]
   [Countries or geographical areas involved]
   [Existing privacy, compliance or DPO arrangements]
   [Relevant sector rules or regulators]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.