As of 13 August 2026, AI cannot create a data protection audit for your small business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the ICO guidance on data protection and UK GDPR, then create a folder containing the current privacy notice, records of processing, retention policy, breach procedure, data protection impact assessments, processor contracts, international transfer documents and information-security policies.
   2. Ask the owner and relevant staff for a plain-language list of every service, system, spreadsheet and paper process that collects, uses, stores or shares personal data.
   3. Record the data subjects, data categories, purposes, recipients, locations, retention periods, access controls and suppliers for each process, marking unknown answers as unknown rather than guessing.
   4. Paste the business description, process list and supporting documents into the prompt, keeping confidential personal data out of the chatbot and replacing it with redacted examples.
   5. Run the prompt and save the resulting working paper with links to the ICO or other official sources it identifies for checking.
   6. Compare every claimed control and retention period in the draft against the actual documents and staff answers, then correct unsupported statements and add the missing evidence requests.
   7. Send the corrected audit, unresolved high-risk items and source links to a solicitor or qualified data protection specialist for a compliance conclusion and prioritised remedial advice.

   Prompt

   Create a UK GDPR data protection audit working paper for a small business in [industry] with [number] staff and [main services]. Use only the information and documents I provide. Do not invent processing activities, legal bases, retention periods, security controls, contracts or incidents. Separate confirmed facts, reasonable inferences and unknowns.
   
   Produce these sections:
   1. Scope, assumptions and missing evidence.
   2. A processing-activities inventory covering data subjects, personal data categories, purposes, systems, recipients, international transfers, retention and access controls.
   3. A check against the main UK GDPR accountability areas, including transparency, lawful basis, special category data where relevant, data subject rights, processor contracts, security, breach response, retention, international transfers, records of processing, data protection impact assessments and governance.
   4. For each area, state the evidence supplied, the gap, why the gap may matter, and a practical next action.
   5. A risk register with risk description, affected data or process, evidence status, suggested priority and owner placeholder. Do not assign a legal conclusion or claim that the business is compliant.
   6. A document and interview request list for the evidence still needed.
   7. A 30-day action plan ordered by dependency and risk.
   
   For every legal or regulatory point, identify the relevant ICO or official UK source to check and quote no requirement unless it is supported by the supplied material or a source I can open. Flag anything that needs a solicitor or qualified data protection specialist. End with the exact statement: This is not professional advice. A serious case needs a solicitor or qualified data protection specialist.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.