As of 13 August 2026, AI can only partly create a record of processing activities for your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 2 hours until you can act on the result.

   How to actually do it

   1. Open a document or spreadsheet and list every department, service, customer journey, internal process and system that handles personal data.
   2. Gather the current privacy notice, retention policy, data protection policy, processor contracts, supplier list, system list and any data-flow or security documentation.
   3. Paste the business information and documents into a chatbot, using the supplied prompt, and ask it to produce the draft record and gaps list without filling unknowns.
   4. Compare each drafted processing activity against the department and system list, adding any activity the model missed and correcting names, data categories, recipients and purposes from your source documents.
   5. Ask the chatbot to produce a second version containing only confirmed facts, with every unresolved item retained in a separate questions list.
   6. Send the confirmed draft, the gaps list and the underlying source documents to your data protection specialist or solicitor for a completeness and legal review before adopting it.

   Prompt

   Create a draft record of processing activities for a UK business under the UK GDPR using only the information I provide below. Do not invent processing activities, suppliers, data categories, retention periods, international transfers, lawful bases, security measures or other facts. Where information is missing or uncertain, write "To confirm" and add it to a separate gaps and questions list.
   
   Present the result as a clear table with one row for each processing activity and these columns: business area or owner; processing activity; purpose; categories of data subjects; categories of personal data; special category or criminal offence data; source of the data; recipients and processors; retention period or deletion rule; storage locations; international transfers and safeguards; lawful basis; additional condition where special category data is used; security measures; data protection impact assessment status; and notes.
   
   After the table, provide:
   1. a list of missing information and precise questions for the business;
   2. assumptions, with none treated as established facts;
   3. a list of suppliers or systems that need their contracts checked;
   4. a list of possible international transfer issues to confirm;
   5. a short plain-English explanation of which parts must be checked by the business or a data protection professional before adoption.
   
   Use UK terminology and British English. Keep the record factual and concise. Do not decide that the business is compliant, do not give legal conclusions, and do not cite a lawful basis unless it is supported by the information supplied.
   
   Business information:
   [Paste your business description, departments, services, systems, suppliers, policies, contracts, data maps and any existing privacy or retention information here.]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.