As of 13 August 2026, AI can only partly check your app for UK GDPR risks.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, developer skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your repository, deployment configuration and current privacy documentation, and remove live personal data, credentials, access tokens and production secrets before copying anything.
   2. Write a data-flow description covering what personal data the app collects, why it collects it, who can access it, where it is hosted, which suppliers receive it, how long it is kept and how users exercise their rights.
   3. Paste the data-flow description, relevant application code, authentication and authorisation logic, storage and logging configuration, cookie or tracking code, deletion workflows and supplier details into a chatbot using the supplied prompt.
   4. Add the current ICO or GOV.UK material your organisation uses, and ask the model to distinguish evidence-based technical findings from questions requiring a DPO, privacy solicitor or security lead.
   5. Run the technical tests proposed for each finding, then compare the results with the relevant code, live configuration and documented data flow rather than accepting an untested claim.
   6. Send the prioritised findings and unresolved legal questions to your DPO or a UK privacy solicitor, and record their decisions, owners and remediation dates in your risk register.

   Prompt

   Act as a cautious UK privacy and application-security reviewer. Review only the code, architecture, data-flow description, configuration and policies I provide below. Do not claim that the app is compliant, do not invent facts, and do not treat missing information as evidence that a control exists.
   
   Identify possible risks under the UK GDPR and, where relevant, the Privacy and Electronic Communications Regulations. Separate technical observations from legal or governance questions that need a qualified UK data protection professional. For every finding, give:
   1. severity: low, medium or high, with no claim of legal certainty;
   2. the exact evidence from my material;
   3. the affected personal data, processing activity or system component;
   4. why it may create a UK privacy or security risk;
   5. a practical remediation or investigation step;
   6. a test I can run to check the technical part;
   7. what information is still missing;
   8. whether the point should be reviewed by my DPO, privacy solicitor or security lead.
   
   Check specifically for unnecessary collection or retention, unclear purposes, excessive permissions, insecure storage or transmission, access control failures, logging of personal data, secrets in code, third-party processors and transfers, cookies and tracking, subject-rights workflows, deletion and correction, breach detection, data protection by design, and documentation of lawful basis. Do not reproduce personal data or secrets in your answer. Mark any issue that cannot be assessed from the supplied material.
   
   At the end, produce a prioritised action list and a separate list titled "Questions for a UK data protection professional". Use the ICO and GOV.UK sources I provide for source checking, and quote links only when they are present in those materials.
   
   Application context:
   [describe the app, users, countries, purposes and environments]
   
   Data-flow and supplier information:
   [paste a data-flow description, hosting details, processors, retention rules and transfer information]
   
   Relevant code and configuration, with secrets and live personal data removed:
   [paste selected files or excerpts]
   
   Current privacy, security and retention documents:
   [paste the relevant text]
   
   Sources supplied for checking:
   [paste current ICO or GOV.UK links and extracts]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.