As of 13 August 2026, AI can only partly draft a UK GDPR data processing agreement.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the current ICO guidance on controller and processor contracts and gather the proposed agreement, service description and any existing privacy or security schedules.
   2. Ask the controller and processor to provide the parties' legal names, addresses, services, data categories, data subjects, purposes, duration and processing operations.
   3. Collect the processor's security measures, sub-processor list, locations, overseas access details, breach contact process, deletion arrangements and audit terms.
   4. Paste those confirmed facts into the prompt, leaving unknown items marked as unknown rather than guessing, and generate the draft with the core agreement and schedules.
   5. Compare every factual clause against the service agreement, security documentation, sub-processor register and transfer records, then correct the draft without filling gaps by assumption.
   6. Send the completed draft and the unresolved-facts table to a UK solicitor or suitably qualified data protection professional for review before anyone signs it.

   Prompt

   Draft a UK GDPR data processing agreement for the following arrangement. This is a working draft, not professional advice, and must not invent facts or silently fill gaps.
   
   Controller: [legal name, company number if relevant, address]
   Processor: [legal name, company number if relevant, address]
   Services being provided: [description]
   Personal data processed: [categories of data]
   Data subjects: [categories of people]
   Processing operations: [what the processor does with the data]
   Purpose and duration: [purpose and contract duration]
   Documented instructions from the controller: [instructions]
   Sub-processors: [names, locations and services, or state that this is unknown]
   International transfers or overseas access: [details, or state that this is unknown]
   Security measures: [technical and organisational measures]
   Breach notification process: [agreed contact and timing, or state that this is unknown]
   Deletion or return of data: [requirements at the end of the services]
   Audit and inspection arrangements: [requirements]
   Controller assistance required: [rights requests, breach support, DPIAs and regulator queries]
   Governing law and jurisdiction: [choice of UK jurisdiction]
   
   Draft clear clauses addressing the mandatory processor-contract requirements under the UK GDPR, including documented instructions, confidentiality, security, sub-processors, assistance, audits, international transfers, and deletion or return of data. Separate the core agreement from a schedule of processing details and a security schedule. Use square-bracketed placeholders for anything missing. After the draft, provide a table listing each unresolved fact, why it matters, and who must confirm it. Flag any clause that depends on the parties' actual roles or transfer arrangements. Do not state that the agreement is compliant, do not choose legal wording for an unknown fact, and identify the points a UK solicitor should review against current ICO guidance.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.