As of 13 August 2026, AI can only partly check your privacy notice for UK GDPR compliance.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the current ICO guidance on privacy information and transparency, then save the relevant pages or links alongside the complete privacy notice.
   2. Gather the organisation facts behind the notice, including the data collected, purposes, lawful bases, sources, processors, recipients, international transfers, retention approach, individual rights and any profiling or special category data.
   3. Remove passwords, access tokens and unnecessary personal records, then paste the notice and the organisation facts into a chatbot with the copyable prompt.
   4. Ask the chatbot to produce its findings in a table with the quoted notice text, issue type, ICO or GOV.UK source, missing evidence and proposed draft wording.
   5. Compare every factual finding about your organisation with your records, processor contracts, retention schedule, transfer assessments and data protection impact assessments, correcting any invented or outdated detail.
   6. Send the unresolved legal questions and proposed changes to your data protection officer, UK data protection specialist or solicitor before publishing the revised notice.

   Prompt

   Check the privacy notice below for UK GDPR transparency compliance as at 2026-08-13. Use current ICO guidance and GOV.UK sources where available, and identify the source for each material finding. Do not give a general assurance and do not invent facts about my organisation.
   
   Separate your review into:
   1. Information that appears to be present and clearly explained.
   2. Information that is missing, vague or internally inconsistent.
   3. Statements that may be inaccurate or need evidence from my organisation.
   4. Questions I must answer before the notice can be finalised.
   5. Suggested replacement wording, clearly labelled as draft wording rather than legal advice.
   
   Check, where relevant, the identity and contact details of the controller, any data protection officer contact, purposes and lawful bases, categories of personal data, data sources, recipients and processors, international transfers and safeguards, retention periods or criteria, individual rights, the right to complain to the ICO, automated decision-making and profiling, children and special category data, and whether the notice is clear and accessible. Also flag where UK PECR or another rule may need a separate check, without pretending to complete that check.
   
   For every finding, quote the relevant passage from the notice, explain the issue in plain English, rate it as missing, unclear, potentially inaccurate or apparently adequate, and state what evidence or decision is needed. Finish with a short list of changes that should be reviewed by a UK data protection solicitor or qualified data protection specialist before publication.
   
   Organisation context:
   - Organisation type: [insert]
   - Services and user groups: [insert]
   - Personal data collected: [insert]
   - Purposes and lawful bases: [insert]
   - Data sources: [insert]
   - Processors and recipients: [insert]
   - International transfers: [insert]
   - Retention approach: [insert]
   - Automated decision-making or profiling: [insert]
   - Children or special category data: [insert]
   
   Privacy notice:
   [paste the complete current notice here]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.