As of 13 August 2026, AI cannot check an AI tool for UK GDPR risks.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the AI supplier's privacy notice, data processing terms, terms of service, security information, subprocessor list, international transfer information and retention information.
   2. Write down the proposed use, the people affected, the data categories, the business purpose, the expected retention and whether special category or criminal offence data is involved.
   3. Ask the supplier for any missing information about controller and processor roles, hosting locations, subprocessors, international transfers, model training, deletion, security and support access.
   4. Redact unnecessary personal data and confidential credentials from the documents, then paste the prompt and the labelled material into a chatbot.
   5. Compare every supplier-specific finding in the output with the exact passage in the supplied documents, and mark unsupported claims as unknown rather than accepting them.
   6. Send the risk register, unanswered questions and source documents to your solicitor or qualified data protection specialist before approving the tool or putting personal data into it.

   Prompt

   Assess the proposed use of an AI tool for UK GDPR risks in a UK business. This is not professional advice and must not be presented as a final legal conclusion.
   
   Business and use case:
   - Business type and location: [describe]
   - Proposed AI tool and supplier: [name and website]
   - What the tool will do: [describe]
   - Who will use it and why: [describe]
   - Whether the business decides the purposes and means of processing: [known, unknown or explain]
   - Personal data involved: [list categories, or say none known]
   - Special category or criminal offence data: [known, unknown or explain]
   - People affected: [customers, staff, children, patients, or other groups]
   - Expected volume and retention period: [details or unknown]
   - Existing safeguards and policies: [details]
   
   Paste below only information you are authorised to share. Redact names, contact details, account numbers, access tokens, unique identifiers and unnecessary personal data.
   
   Supplier material:
   [Paste the supplier privacy notice, data processing terms, terms of service, security information, subprocessor list, international transfer information and retention information. Label each document and include its date if shown.]
   
   Produce:
   1. A factual description of the proposed processing and any unknowns.
   2. A table with each potential UK GDPR risk, the evidence for it, the affected people or rights, the likelihood and impact as qualitative labels only, existing controls, and a proposed next action.
   3. Separate checks for controller or processor roles, lawful basis, transparency, purpose limitation, data minimisation, accuracy, retention, security, processor terms, subprocessors, international transfers, data subject rights, automated decision-making, special category data and whether a DPIA may be needed.
   4. A list of claims that cannot be assessed from the supplied material.
   5. Questions to send to the supplier and questions for our solicitor or qualified data protection specialist.
   6. A clear conclusion using only: lower apparent risk based on the supplied information, material unanswered questions, or do not proceed without specialist review. Do not invent facts, legal requirements, supplier practices or risk ratings. Quote or identify the source passage for every supplier-specific finding.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.