As of 13 August 2026, AI cannot check your privacy notice for UK GDPR compliance.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the current privacy notice, your record of processing activities, retention policy, processor list, international-transfer records, cookie information and rights-handling procedure.
   2. Gather the actual facts about what personal data your organisation collects, why it uses it, the lawful bases, who receives it, where it is transferred, how long it is kept and how people exercise their rights.
   3. Paste the complete notice, the organisation facts and the supporting records into the prompt, removing unnecessary personal data before uploading them.
   4. Ask the chatbot to produce the requested table and to separate obvious omissions from issues requiring legal judgement.
   5. Compare every flagged fact against your systems, supplier contracts, cookie scan and records of processing, correcting the notice where the wording does not match what you actually do.
   6. Send the notice, the AI findings, the supporting records and the unresolved questions to a UK data protection solicitor or qualified data protection professional before relying on it for a serious or complex processing activity.

   Prompt

   Act as a UK GDPR privacy-notice review assistant, not a solicitor or data protection officer. Review the privacy notice below against the current UK GDPR transparency requirements and applicable guidance from the UK Information Commissioner's Office. Do not give a final legal-compliance conclusion. Instead, produce a table with these columns: notice section, requirement or issue, exact text or fact relied on, risk if missing or inaccurate, information needed from me, and suggested plain-English amendment. Separate clear omissions from points that require legal judgement. Do not invent facts, processing activities, retention periods, recipients, international transfers, lawful bases or rights. Flag anything you cannot verify from the material supplied. State which parts I must confirm against our actual systems and records, and finish with a short list of questions for a UK data protection solicitor or qualified data protection professional.
   
   Organisation and processing details:
   [describe the organisation, services, users, data subjects, personal data collected, purposes, lawful bases, recipients, processors, international transfers, retention periods, rights process, cookies or tracking, automated decision-making, contact details and any data protection officer]
   
   Privacy notice:
   [paste the complete current privacy notice]
   
   Internal facts or policies to compare against:
   [paste relevant records, supplier information, retention policy, cookie scan or other evidence]
   
   Use British English. Quote the relevant notice wording when identifying a problem. Do not state that the notice is compliant merely because it contains the usual headings.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.