As of 13 August 2026, AI can only partly draft a response to a subject access request.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the original subject access request, the identity or authority check, your organisation's SAR procedure and the relevant case folder.
   2. Gather the search log, results from each relevant system, proposed attachments, correspondence with the requester and any records containing third-party information.
   3. Remove unnecessary personal data from the material before putting it into a chatbot, and label each document with its source and purpose.
   4. Paste the material into the prompt in separate sections, then ask the model to produce the covering letter, data schedule, issue list and approval checklist.
   5. Compare every statement in the draft with the source records, checking the requester’s details, data categories, attachments, missing searches and explanations for redactions.
   6. Send the draft and the underlying search record to your data protection lead or solicitor for decisions on exemptions, third-party information, privilege, scope and any deadline issue.
   7. Apply the approved redactions and amendments, obtain the organisation's required sign-off, then send the final response and retain the search and approval record.

   Prompt

   Draft a UK GDPR subject access request response using only the materials supplied below.
   
   Requester and request:
   [PASTE THE REQUEST AND ANY IDENTITY OR AUTHORITY CHECK INFORMATION]
   
   Search results and personal data to consider:
   [PASTE THE RECORDS, SEARCH LOG, EMAILS, DOCUMENT EXTRACTS AND ATTACHMENT LIST]
   
   Relevant organisation policy and procedure:
   [PASTE THE CURRENT SAR PROCEDURE, RETENTION RULES AND ESCALATION RULES]
   
   Known issues:
   [PASTE ANY THIRD-PARTY DATA, CONFIDENTIALITY CONCERNS, PRIVILEGE CONCERNS, MISSING RECORDS, EXTENSIONS OR OTHER UNCERTAINTIES]
   
   Produce:
   1. A clear draft covering letter in plain British English.
   2. A schedule listing each category of personal data supplied and where it appears.
   3. A separate list of records or information that may need withholding, redaction or specialist review, with the reason stated as an issue to verify, not as a final legal decision.
   4. A list of unanswered questions, missing searches and factual inconsistencies.
   5. A final checklist of attachments and approval steps before sending.
   
   Do not invent facts, records, dates, legal conclusions, exemptions or reasons for withholding information. Do not include personal data that is not in the supplied material. Do not decide that an exemption applies without flagging the decision for review by the organisation's data protection lead or solicitor. Mark every uncertainty clearly. This is a drafting exercise, not professional advice.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.