As of 13 August 2026, AI can only partly create UK GDPR training for your staff.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open your current privacy notice, data protection policy, information security policy, breach procedure, retention policy and subject access request procedure, then gather the latest approved versions.
   2. Ask your data protection lead or responsible manager for the staff roles, training duration, common mistakes, approved examples and any procedures staff must follow.
   3. Paste those documents and details into the prompt, replacing each bracketed slot and marking any missing information as [TO CONFIRM].
   4. Ask the chatbot to generate the course, then save the modules, slides, scenarios, quiz, facilitator notes and confirmation list as separate working sections.
   5. Compare every organisation-specific instruction against the approved policies and ask your data protection lead or solicitor to check legal claims, breach handling, special category data and subject access request content.
   6. Correct the draft, remove every unresolved [TO CONFIRM] item or assign it to an owner, then run the quiz with a small staff group and update examples that they misunderstand before sending the final training to all staff.

   Prompt

   Create a practical UK GDPR training course for staff at [organisation type] in [sector]. The audience is [roles and level of experience], and the course will take [duration]. Use only the information in the source material below for organisation-specific claims. Do not invent policies, procedures, data flows, legal bases, retention periods, breach-reporting arrangements or security controls. Explain general UK GDPR points in plain British English, flag anything that requires confirmation against current official guidance, and state clearly where a data protection specialist or solicitor must check the content.
   
   Produce:
   1. Learning objectives.
   2. A modular course outline with timings.
   3. Slide-by-slide content with short speaker notes.
   4. Role-specific examples for [roles].
   5. Scenarios covering personal data handling, special category data, sharing, phishing, data breaches, subject access requests and secure disposal, but do not state that a particular action is lawful unless the supplied material supports it.
   6. A short knowledge check with answers and explanations.
   7. A facilitator checklist and a list of points that must be confirmed by our data protection lead before delivery.
   8. A plain disclaimer that this is internal training material, not professional advice.
   
   Make the training practical rather than legalistic. Separate confirmed facts from assumptions. Where the source material is silent, write [TO CONFIRM] instead of filling the gap.
   
   Organisation-specific source material:
   [PASTE YOUR CURRENT PRIVACY NOTICE, DATA PROTECTION POLICY, INFORMATION SECURITY POLICY, BREACH PROCEDURE, RETENTION POLICY, SAR PROCEDURE, STAFF ROLES AND APPROVED EXAMPLES HERE]

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.