As of 13 August 2026, AI cannot find personal data for a subject access request.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the subject access request and your organisation's current data map, then make a list of every system, mailbox, messaging channel, shared drive, paper file and backup that could contain the requester's personal data.
   2. Ask the authorised owners of those sources for exports or search results, preserving the original record identifiers, dates and surrounding context rather than copying isolated snippets.
   3. Remove unrelated data only under your organisation's approved handling process, and use an approved AI environment rather than uploading personal data to an unapproved chatbot.
   4. Paste the source list and upload the authorised records into the prompt, asking the model to classify matches, flag third-party data and identify sources or periods that were not searched.
   5. Compare the model's source-by-source results with the data map and the owners' search records, then make the owners rerun any missing or weak searches and preserve the new results.
   6. Give the complete collection, the AI's uncertainty list and the original search log to your data protection lead or solicitor to decide what can be disclosed and to approve the final response.

   Prompt

   I am helping [ORGANISATION] handle a UK GDPR subject access request. Use only the records and source list I provide, and do not invent documents, people, dates or conclusions. This is not professional advice.
   
   First, create a search and collection plan covering each source in the source list, including email, messaging, file storage, case-management systems, HR or customer systems, backups and paper records where they are listed. For each source, specify the authorised person who should search it, the search terms to use, date or record filters, and the output to preserve.
   
   Then review the supplied records and produce a table with: record identifier, source, date, people mentioned, requester-related personal data found, likely relevance, possible third-party data, possible special-category or legally sensitive material, and a short reason for each classification. Quote only the minimum text needed and keep the original record identifier so a human can inspect it.
   
   Separate the results into: likely in scope, likely out of scope, needs human review, and no match. List every source or period that could not be searched and every unanswered question that could make the collection incomplete. Do not decide whether an exemption applies, do not disclose information, and do not claim the search is complete. End with a checklist for the organisation's data protection lead or solicitor to verify before any response is sent.
   
   Source list:
   [PASTE AUTHORISED SOURCE LIST]
   
   Records or exports:
   [PASTE OR UPLOAD AUTHORISED RECORDS]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.