As of 13 August 2026, AI can only partly draft an employee privacy notice.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Ask your HR, payroll, IT and operations leads for the current data map, including the data categories, purposes, systems, recipients, processors, monitoring, international transfers and retention schedules.
   2. Open your existing staff handbook, HR privacy documents, processor list and approved data protection records, then remove employee names, contact details and other identifying information before using them as source material.
   3. Fill the bracketed sections in the prompt with confirmed business facts, marking unknown items as unknown rather than guessing, and paste the completed prompt into an AI chat.
   4. Ask the model to produce the notice and its missing-facts and high-risk review checklist, then save both the draft and the source facts used to create it.
   5. Compare every factual statement in the draft with your HR, payroll, IT and supplier records, and check the rights, lawful bases, retention, monitoring, special-category data and transfer sections against current UK guidance.
   6. Send the checked draft and its unresolved checklist to a UK solicitor or data protection specialist for review, then publish the approved version through the staff channels and record its date and version.

   Prompt

   Draft an employee privacy notice for a UK business under the UK GDPR and the Data Protection Act 2018. Use only the business facts I provide below. Invent nothing. Where a fact is missing, write [FACT NEEDED] and list the question I must answer. Do not choose a lawful basis, retention period, international transfer mechanism, monitoring justification or special-category condition unless the supplied facts support it. Clearly separate confirmed facts from assumptions and legal issues requiring a solicitor or data protection specialist. Cover: who the employer is and how to contact it; the categories of employee, worker and applicant data collected; the purposes of processing; lawful bases; special-category and criminal-offence data where relevant; sources of data; recipients and processors; international transfers; retention periods or the criteria used to set them; employee rights and how to exercise them; automated decision-making and profiling; workplace monitoring; complaints and the right to complain to the ICO; data protection contact details; and the date and version of the notice. Write in plain English for employees, not lawyers. Add a short checklist of unsupported or high-risk statements that need professional review. Do not include real employee names, contact details or other identifying information in the draft. Business facts: [BUSINESS NAME, SECTOR AND SIZE] [EMPLOYER CONTACT DETAILS] [EMPLOYEE, WORKER AND APPLICANT CATEGORIES] [HR AND PAYROLL SYSTEMS] [DATA CATEGORIES COLLECTED] [PURPOSES OF USE] [LAWFUL BASES ALREADY APPROVED] [SPECIAL-CATEGORY OR CRIMINAL-OFFENCE DATA] [MONITORING, CCTV, DEVICE OR EMAIL USE] [RECIPIENTS AND PROCESSORS] [INTERNATIONAL TRANSFERS] [RETENTION SCHEDULES] [EMPLOYEE RIGHTS PROCESS] [DPO OR PRIVACY CONTACT] [COMPLAINTS PROCESS] [NOTICE DATE AND VERSION]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.