As of 13 August 2026, AI can only partly draft a response to a UK GDPR subject access request.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the original subject access request and the identity-check record, then paste the request wording, dates and identity-check outcome into the prompt.
   2. Ask the records owners or data protection team for the search terms, systems searched, records found and proposed disclosure set, and paste only the approved material into the prompt.
   3. Record each proposed redaction or withholding decision with its approved legal basis, any third-party information assessment and any confidentiality concerns, then paste those details into the prompt.
   4. Paste the organisation's approved name, contact address, response contact and complaint wording, and ask the model to produce the draft and verification table.
   5. Compare every factual statement in the draft with the request, search log, disclosure bundle and approved decisions, removing anything that has no source.
   6. Ask your data protection lead or solicitor to check the search completeness, exemptions, third-party information, redactions and deadline before sending the response and disclosure.
   7. Send the final response through the organisation's approved secure channel and retain the request, search record, decision log, disclosure copy and final letter.

   Prompt

   Draft a UK GDPR subject access request response for an organisation acting as data controller. Use only the information I provide and do not invent records, dates, exemptions, searches or legal conclusions. Structure the response with: the requester's identity and request date, the scope answered, the personal data and documents being disclosed, any information withheld, the reason for each withholding decision, third-party information handling, the records searched, the contact for queries, and the right to complain to the ICO. Distinguish clearly between facts supplied by me, missing information and suggested wording. Do not decide that an exemption applies unless I have supplied that decision and its basis. Flag every unresolved point that a data protection specialist must check. Use plain, professional UK English and do not include personal data that is not necessary for the letter.
   
   Request and correspondence:
   [PASTE]
   
   Identity-check outcome:
   [PASTE]
   
   Searches performed and records found:
   [PASTE]
   
   Data proposed for disclosure:
   [PASTE]
   
   Information proposed to be withheld, with the approved reason for each item:
   [PASTE]
   
   Third-party information and consent or balancing assessment:
   [PASTE]
   
   Organisation name, contact details and approved response details:
   [PASTE]
   
   Before drafting, list the missing inputs and ask no more than five precise questions. After I answer, produce the draft response followed by a verification table with columns for statement, source supplied by me, and human check required.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.