As of 13 August 2026, AI cannot check whether your international data transfers comply with UK GDPR.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open your transfer register, supplier list, processor contracts and security records, then list every country, recipient, data type, purpose, transfer route and onward recipient involved.
   2. Collect the relevant data processing agreements, UK International Data Transfer Agreement or UK Addendum documents, adequacy decision evidence, transfer risk assessments and records of supplementary measures.
   3. Remove unnecessary personal data and confidential secrets, then paste the redacted facts and documents into a chatbot with the prompt above, keeping each transfer clearly labelled.
   4. Ask the model to produce the transfer-by-transfer table and missing-evidence list, rather than asking whether the whole organisation is compliant in one sentence.
   5. Open the current ICO and GOV.UK guidance and compare each claimed transfer mechanism, country status and required document against those sources, recording any disagreement or uncertainty.
   6. Send the evidence pack, the model's gap list and your source comparison to your data protection officer or a UK solicitor for a final decision and written approval before continuing or starting the transfer.

   Prompt

   Assess the following international personal data transfers under UK GDPR as a preliminary compliance review, not a final legal conclusion.
   
   Business context:
   - Organisation and role: [controller, processor or joint controller]
   - Types of personal data: [describe]
   - Data subjects: [describe]
   - Processing purpose: [describe]
   - Countries receiving the data: [list each country]
   - Recipient organisations and roles: [list]
   - Direct transfers or onward transfers: [describe]
   - Existing contracts and transfer documents: [paste relevant clauses or summarise them]
   - Security measures: [describe encryption, access controls, retention and other measures]
   - Any relevant regulator, customer or contractual requirements: [describe]
   
   For each transfer, produce:
   1. A plain-English description of the transfer and the information still missing.
   2. The likely UK GDPR Chapter V route, such as an adequacy decision, appropriate safeguards or a derogation, without assuming that a route applies.
   3. The documents and facts needed to support that route.
   4. Whether a transfer risk assessment appears necessary and the questions it must address.
   5. Potential gaps involving onward transfers, access by foreign public authorities, contractual controls, security, retention and data subject rights.
   6. Practical supplementary measures that could reduce risk, clearly labelled as suggestions rather than proof of compliance.
   7. A table with columns for issue, evidence supplied, evidence missing, risk if unresolved, and next action.
   
   Use only the current materials I provide and clearly identify any point that needs checking against current ICO or GOV.UK guidance. Do not invent facts, adequacy decisions, contractual terms or legal conclusions. State that this is not professional advice and finish with the questions a UK solicitor or qualified data protection specialist must answer before the transfer is approved.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.