As of 13 August 2026, AI can only partly create a personal data breach response plan for a UK business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the business's current information security, incident management, privacy, retention and supplier policies, then remove live personal data and collect the relevant redacted text.
   2. Gather the current role titles, escalation contacts, key systems, processors, out-of-hours arrangements, backup arrangements and approved communication channels.
   3. Paste the redacted business details and policies into a chatbot with the copyable prompt, and ask it to create the plan without inventing missing facts.
   4. Export the draft into the business's SOP format, then replace every placeholder with a confirmed role, contact route, system or supplier detail.
   5. Compare the response process and notification decision record against current ICO guidance, the business's processor contracts, insurance terms and internal reporting requirements.
   6. Ask the data protection lead or a UK data protection solicitor to check the legal decision points, notification wording and handling of high-risk incidents.
   7. Run the proposed exercise scenario with the relevant staff, record where the process fails, and update the plan, contacts and incident log templates before approving it.

   Prompt

   Create a practical personal data breach response plan for a UK business.
   
   Business type: [business type]
   Business size and locations: [details]
   Data held: [categories of personal data, using redacted descriptions only]
   Main systems and suppliers: [systems, cloud services and processors]
   Incident reporting route: [email address, phone number or ticketing route]
   People and roles: [named role titles, not unnecessary personal data]
   Existing policies: [paste relevant redacted policy text]
   Working hours and out-of-hours arrangements: [details]
   
   Produce:
   1. A short purpose and scope section.
   2. A numbered response process from initial report through closure.
   3. A responsibility table covering the incident lead, IT or security, data protection lead, communications, senior management and any processor.
   4. Immediate containment and evidence-preservation actions.
   5. A fact-gathering checklist that does not ask staff to paste live personal data into this chat.
   6. A decision record for assessing risk to individuals and whether regulatory or individual notification may be required. Do not decide that a notification is legally required without stating the facts still needed and the point that must be escalated.
   7. Draft internal, processor, regulator and affected-person communication templates with clearly marked placeholders.
   8. An incident log, decision log and post-incident review checklist.
   9. A short exercise scenario for testing the plan.
   
   Use plain UK English. Separate confirmed facts from assumptions and open questions. Do not invent contacts, systems, deadlines or legal conclusions. Flag every item that needs checking against current ICO guidance, the business's contracts and its insurance requirements. This is not professional advice. State clearly where a serious case needs a UK data protection solicitor or other qualified data protection professional. Format the result so it can be copied into an internal SOP.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.