As of 13 August 2026, AI can draft a GDPR FAQ for your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 30 minutes until you can act on the result.

   How to actually do it

   1. Open your current privacy notice, records of processing, retention policy, supplier list and customer support questions.
   2. Gather the exact facts about data collected, purposes, lawful bases, recipients, international transfers, retention periods, rights requests and privacy contact details.
   3. Paste those documents and facts into the prompt, replacing each bracketed slot and leaving a slot marked [NEEDS CONFIRMATION] where the business does not have a confirmed answer.
   4. Ask the chatbot to produce the FAQ and source notes, then remove any answer that describes a practice your business does not actually follow.
   5. Compare every factual answer with the privacy notice, processing records, retention policy and current ICO or GOV.UK guidance, correcting unsupported legal statements.
   6. Send the completed draft to your data protection lead or a solicitor for review before publishing it in your help centre.

   Prompt

   Draft a clear, concise GDPR FAQ for this UK business using only the information supplied below. Write for customers in plain British English. Distinguish between the UK GDPR, the Data Protection Act 2018 and PECR where relevant, and do not claim that a rule applies unless the supplied facts and current official guidance support it. Do not invent processing activities, lawful bases, retention periods, international transfers, safeguards, contact details or customer rights. For each answer, state when the answer depends on our actual practice and mark missing information as [NEEDS CONFIRMATION]. Include questions and answers covering what personal data we collect, why we use it, our lawful basis, retention, sharing, international transfers, customer rights, how to contact us and how to complain, but include only topics that apply. Add a short source note for each legal statement naming the relevant current ICO or GOV.UK guidance, and flag any point that needs review by our data protection lead or solicitor. This is not professional advice. Business details: [BUSINESS NAME AND TYPE]. Services: [SERVICES]. Personal data collected: [DATA]. Purposes: [PURPOSES]. Lawful bases: [LAWFUL BASES]. Retention rules: [RETENTION]. Recipients and suppliers: [SHARING]. International transfers: [TRANSFERS]. Customer rights process: [RIGHTS PROCESS]. Privacy contact: [CONTACT]. Complaints process: [COMPLAINTS]. Existing privacy notice and policies: [PASTE DOCUMENTS].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.