As of 13 August 2026, AI can only partly handle a UK GDPR subject access request.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, power-user skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the request, your current data map and the ICO subject access request guidance, then record the request date, the requester, the scope and the identity-verification status.
   2. Ask the requester for clarification only where the scope is genuinely unclear, and keep the original request and all correspondence together.
   3. Export or collect potentially relevant records from each approved system and custodian, preserving the source, date, access controls and search terms rather than pasting live personal data into an unapproved chatbot.
   4. Remove unnecessary personal data from the material you plan to use with AI, then paste the prompt with the request, search coverage and redacted records into an approved AI tool.
   5. Use the generated search plan and record index to identify missed systems, custodians, date ranges, duplicates, irrelevant records and third-party information, then update the evidence pack.
   6. Compare every proposed exemption and redaction with the current ICO guidance and the underlying record, and have your data protection lead or solicitor decide each disputed disclosure.
   7. Prepare the final response from the approved disclosure schedule, check the recipient and attachments, record the decisions and send it through your organisation's approved channel.

   Prompt

   Help me prepare a UK GDPR subject access request response pack, but do not make the final legal decisions or send anything. Use only the information I provide and identify every assumption.
   
   Request date: [DATE]
   Requester and identity-verification status: [DETAILS, WITH ONLY THE MINIMUM NECESSARY PERSONAL DATA]
   Organisation and contact details: [DETAILS]
   Relevant systems, custodians and date ranges searched: [DETAILS]
   Records and documents found: [PASTE OR ATTACH REDACTED RECORDS WHERE POSSIBLE]
   Known third-party information: [DETAILS]
   Known special-category or criminal-offence data: [DETAILS]
   Any previous correspondence or scope clarification: [DETAILS]
   
   Produce:
   1. A factual chronology and a list of unanswered questions.
   2. A search plan showing each system, custodian, date range and search term still needed.
   3. A record index linking each item to the requester and flagging duplicates, irrelevant material, third-party data and special-category data.
   4. A proposed disclosure schedule.
   5. A proposed redaction schedule. For every proposed redaction, quote the smallest relevant passage, state the reason, identify the UK GDPR or Data Protection Act 2018 exemption that may be relevant, and mark it as requiring human or solicitor approval. Do not invent an exemption.
   6. A draft acknowledgement and response letter in plain British English, with placeholders for dates, contact details, complaint rights and the final decision.
   7. A final checklist of decisions that must be made by the organisation's data protection lead or solicitor.
   
   Separate facts, source text, legal rules, assumptions and recommendations. Do not infer identity, consent, employment status or legal exemptions. Do not include personal data that is not needed. If the current rule or deadline is uncertain, tell me to check the current ICO guidance rather than guessing. Cite the relevant ICO or GOV.UK source for each procedural point.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.