As of 13 August 2026, AI can only partly create a UK GDPR compliance checklist for your small business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the ICO data protection guidance and GOV.UK data protection pages, then save the current links you intend to use as sources.
   2. Gather your privacy notice, cookie notice, processor contracts, supplier list, security policy, retention schedule, breach procedure and any record of processing activities.
   3. Ask the people responsible for sales, marketing, HR, IT and customer support to list the personal data they collect, why they use it, where it is stored, who receives it and how long it is kept.
   4. Paste the business details, documents, source links and the copyable prompt into a chatbot, then ask it to produce the checklist with a separate owner and status for every item.
   5. Compare each legal statement and linked source in the draft against the current ICO or GOV.UK page, removing any item that rests on an invented fact or unsupported source.
   6. Send the unanswered questions, high-priority gaps and any item marked 'needs legal assessment' to a solicitor or data protection specialist before treating the checklist as a compliance conclusion.
   7. Assign owners and dates in the checked checklist, then store evidence such as signed contracts, training records, assessments and policy approvals beside the completed items.

   Prompt

   Create a practical UK GDPR compliance checklist for a small business in the United Kingdom.
   
   Business details:
   - Business type and sector: [insert]
   - Number of staff: [insert]
   - Customers or users: [insert]
   - Countries where we operate or sell: [insert]
   - Types of personal data handled: [insert]
   - Special category or criminal offence data handled: [insert]
   - Main processing activities: [insert]
   - Systems and suppliers used, including cloud services: [insert]
   - Whether we use cookies, direct marketing, profiling, monitoring or automated decision-making: [insert]
   - Whether we share data with processors, group companies, public bodies or other third parties: [insert]
   - Current policies, records, contracts and security measures: [insert]
   
   Produce a table with these columns: checklist item, why it may apply, evidence to collect, responsible owner, priority, and status. Separate actions that are likely to apply to most businesses from actions that depend on the facts. Include data protection principles, lawful bases, transparency, data subject rights, processor contracts, international transfers, records of processing, security, personal data breaches, retention, data protection impact assessments, direct marketing, cookies, children’s data, data protection officer requirements, and regulator contact arrangements where relevant.
   
   For every item, state the factual assumption or business answer that makes it applicable. Do not invent facts, legal deadlines, exemptions, regulator decisions or supplier capabilities. Where the answer depends on circumstances, write 'needs legal assessment' and list the facts a solicitor or data protection specialist would need. Use current official UK sources where possible, preferably ICO or GOV.UK, and provide a link for each legal or regulatory statement. Distinguish UK GDPR requirements from the Data Protection Act 2018, PECR and general good practice. End with a list of unanswered questions and a short verification plan. This is a working checklist, not legal advice, and do not present it as proof that the business is compliant.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.