As of 13 August 2026, AI cannot create a privacy policy for your UK business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open a document and record your legal name, trading name, contact details, business activities, website and the types of people whose data you handle.
   2. Gather your data map, customer and employee forms, website analytics settings, cookie list, marketing systems, cloud suppliers, payroll provider and any other service that receives personal data.
   3. Ask each relevant system owner or supplier what data it receives, why it receives it, where it stores it, how long it keeps it, whether it transfers it outside the UK and how it supports rights requests.
   4. Paste the completed facts and any existing privacy notice into the prompt, then ask the chatbot to produce the missing-information checklist, draft, review table and publication checklist in that order.
   5. Compare every statement in the draft against your forms, supplier contracts, cookie settings, retention rules and actual business processes, and replace every unresolved placeholder with a confirmed fact or leave it marked for review.
   6. Send the draft, the issue table and your supporting documents to a UK solicitor or data protection specialist, then publish the approved version in the places where people provide their personal data.

   Prompt

   Act as a drafting assistant, not a solicitor. This is not professional advice. Create a plain-English privacy policy for a UK business using only the facts I provide. Do not invent services, data uses, suppliers, retention periods, lawful bases, international transfers, cookies, security measures or individual rights processes. If information is missing, mark it as [NEEDS CONFIRMATION] and list the exact question I need to answer.
   
   Take account of the UK GDPR, the Data Protection Act 2018 and PECR where relevant, but do not claim that the draft is legally compliant. Separate confirmed facts from assumptions. For each processing activity, show the purpose, personal data involved, data subjects, lawful basis, recipients, retention approach, international transfer position and how people can exercise their rights. Include a separate cookies section only if the facts support one. Flag any point that needs review by a UK solicitor or data protection specialist.
   
   Business details:
   - Legal name: [LEGAL NAME]
   - Trading name: [TRADING NAME]
   - Business type and location: [DETAILS]
   - Contact details for privacy enquiries: [DETAILS]
   - What the business does: [DESCRIPTION]
   - Website, apps and other services: [DETAILS]
   - Customer, employee, supplier and visitor data collected: [DETAILS]
   - How data is collected: [DETAILS]
   - Purposes for using it: [DETAILS]
   - Systems and suppliers that receive or process it: [DETAILS]
   - Any transfers outside the UK: [DETAILS OR UNKNOWN]
   - Retention periods or deletion rules: [DETAILS OR UNKNOWN]
   - Security measures: [DETAILS]
   - Direct marketing by email, text or phone: [DETAILS]
   - Analytics, advertising and other cookies: [DETAILS]
   - Special category or criminal offence data: [DETAILS OR NONE]
   - Children or vulnerable people using the service: [DETAILS OR NONE]
   - Existing privacy notices, consent wording or contracts: [PASTE TEXT OR NONE]
   
   Return: first, a missing-information checklist; second, a structured draft privacy policy with placeholders clearly marked; third, a table of legal and factual issues for professional review; fourth, a short publication checklist. Do not present the draft as final legal advice.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.