As of 13 August 2026, AI can only partly complete a UK GDPR transfer risk assessment.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 2 hours until you can act on the result.

   How to actually do it

   1. Open your organisation's data map, supplier register and international transfer records, then list every exporter, importer, sub-processor, access country, storage country and support country involved.
   2. Gather the relevant data processing agreement, transfer clauses, supplier security documentation, sub-processor list, audit reports, access-control details, encryption information and incident records.
   3. Remove unnecessary personal data from the working material, replace names and identifiers with neutral labels, and paste the factual transfer details and documents into the prompt.
   4. Ask the model to produce the assessment, keeping verified facts, assumptions and missing evidence in separate sections and leaving unsupported conclusions unresolved.
   5. Compare each drafted data flow, country, processing purpose, safeguard and supplier statement against the source records, then correct the draft and mark any unresolved item as evidence required.
   6. Send the corrected assessment and its source pack to your DPO, privacy lead or UK data protection solicitor to verify the legal analysis, residual risk and proposed decision before the transfer proceeds.

   Prompt

   Act as a drafting assistant, not as a solicitor. Prepare a UK GDPR international transfer risk assessment for the proposed transfer described below. Use only the information and documents I provide, and do not invent facts, safeguards, laws or conclusions.
   
   Transfer details:
   - Exporter: [organisation and UK location]
   - Importer and group companies involved: [names and locations]
   - Countries where data is accessed, stored or supported: [countries]
   - Data subjects: [categories of people]
   - Personal data: [categories of data]
   - Special category or criminal offence data: [yes/no and details]
   - Purpose and processing activities: [details]
   - Frequency and duration: [details]
   - Controller, processor or joint-controller roles: [details]
   - Existing transfer mechanism: [details]
   - Contractual, technical and organisational safeguards: [details]
   - Supplier and sub-processor information: [details]
   - Relevant policies, audits, certifications and incident history: [details]
   
   Documents and sources supplied:
   [Paste the relevant contract clauses, supplier answers, technical evidence, policies and current ICO or government guidance here.]
   
   Produce:
   1. A clear description of the data flows and all countries involved.
   2. The transfer mechanism and the assumptions needed to assess it.
   3. A table separating verified facts, missing evidence and assumptions.
   4. An assessment of the laws and practices that could affect access to the data in each destination country, citing the supplied sources and identifying anything that must be checked against current official guidance.
   5. An assessment of whether the safeguards reduce the identified risks, without treating a policy statement as proof that a control works.
   6. Residual risks, affected individuals, mitigating actions, owners and deadlines, leaving unknown fields marked as 'evidence required'.
   7. A draft decision section with the options 'proceed subject to actions', 'pause pending evidence' and 'seek specialist advice'. Do not choose the final option for me.
   8. A short list of questions for the importer and supplier, plus a list of points that a UK data protection solicitor or suitably qualified DPO must verify.
   
   Keep the assessment specific to the evidence supplied. Do not claim that a transfer is lawful merely because a contract or transfer mechanism exists. This is not professional advice, and the final decision must be approved by the organisation's accountable privacy or legal function.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.