As of 13 August 2026, AI can only partly create a personal data breach response plan.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your current breach policy, data map, supplier list, incident escalation procedure and relevant ICO guidance, then remove live personal data and confidential credentials.
   2. Gather the organisation type, systems involved, categories of data, approximate affected groups, incident timeline, containment actions, supplier involvement and internal role names.
   3. Paste the redacted material and the prompt into a chatbot, asking it to produce the plan and mark every unknown as [CONFIRM].
   4. Compare the draft's reporting decision points and record-keeping sections with the current ICO breach-reporting guidance and your organisation's existing policies.
   5. Ask your IT or security lead to test the containment, evidence-preservation and recovery steps against the systems actually used, then record each correction.
   6. Ask your data protection officer or solicitor to assess the incident-specific risk, notification decisions, contractual duties and communications before adopting the plan.
   7. Place the approved plan in the incident-management location, assign named internal roles, add out-of-hours escalation routes and run a tabletop exercise using a redacted scenario.

   Prompt

   Create a UK personal data breach response plan for [ORGANISATION TYPE]. Use the redacted information below and do not invent facts, systems, contacts, legal conclusions or deadlines. If information is missing, mark it as [CONFIRM] and state exactly what must be found.
   
   Organisation and role: [DESCRIPTION]
   Types of personal data handled: [REDACTED DESCRIPTION]
   Systems and suppliers involved: [REDACTED DESCRIPTION]
   Existing policies and procedures: [PASTE REDACTED TEXT]
   Incident scenarios covered: [DESCRIPTION]
   Internal roles and contact routes: [REDACTED CONTACT ROLES, NOT PERSONAL CONTACT DETAILS]
   Locations and affected individuals: [UK, EEA OR OTHER LOCATIONS]
   Existing insurance, contracts or regulator contacts: [REDACTED DESCRIPTION]
   
   Base the structure on UK GDPR accountability and current ICO breach-reporting guidance. Distinguish clearly between facts, assumptions, questions to resolve and legal or risk judgements. Include:
   1. An immediate first-response checklist for containment, preservation of evidence and escalation.
   2. Roles and decision rights for the incident lead, IT or security team, legal or data protection lead, communications team and senior management.
   3. A fact-gathering template covering what happened, when it happened, what data and people are affected, the likely consequences, containment and recovery.
   4. A documented risk-assessment method for deciding whether the breach is likely to risk individuals' rights and freedoms, without deciding the result for me.
   5. Separate decision points for notifying the ICO and communicating with affected people, including the information that must be confirmed before either action.
   6. A record-keeping and evidence log, internal update format, and post-incident review checklist.
   7. Clear escalation points where the organisation must ask its data protection officer, solicitor, insurer or relevant specialist.
   
   Do not provide professional advice, do not claim that notification is or is not required, and do not treat this plan as a substitute for a case-specific decision. End with a table of missing information, its owner, the source to check and the consequence of leaving it unresolved.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.