As of 13 August 2026, AI cannot write a data retention policy for your business.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open your records of processing activities, privacy notices, contracts, processor list and any existing deletion procedure, then gather the data categories, purposes, systems, owners and current retention periods.
   2. Ask the people responsible for HR, finance, sales, customer support, IT, security and compliance to identify records they create, where they store them, why they keep them and what triggers deletion.
   3. Paste the gathered information into the prompt, replacing each bracketed slot and marking unknown information as UNKNOWN rather than guessing.
   4. Paste the resulting draft into a document and compare every retention schedule row with your systems, records of processing activities, contracts, insurance requirements and applicable regulatory records.
   5. Open the current ICO guidance and any relevant regulator or professional guidance identified by the model, then check each flagged legal statement and retention justification against the source.
   6. Send the draft, the source checks and the unresolved decisions to your UK data-protection solicitor or qualified DPO for approval, then assign owners and implement the deletion and legal-hold procedures.

   Prompt

   Draft a UK data retention policy for [BUSINESS NAME], a [BUSINESS TYPE] operating in [LOCATIONS]. Use the business information below and do not invent facts, retention periods, legal obligations, systems or departments. Base the draft on the UK GDPR, the Data Protection Act 2018 and current ICO guidance, but clearly label every point that needs confirmation against the current source or advice from a UK data-protection solicitor or qualified DPO.
   
   Business information:
   - Staff and contractors: [DETAILS]
   - Customers and users: [DETAILS]
   - Suppliers and business contacts: [DETAILS]
   - Data categories held: [LIST]
   - Special category or criminal offence data: [DETAILS OR UNKNOWN]
   - Systems and storage locations: [LIST]
   - Processing purposes: [LIST]
   - Current retention periods, if any: [LIST OR UNKNOWN]
   - Legal, regulatory, contractual or insurance retention requirements: [DETAILS OR UNKNOWN]
   - Deletion, anonymisation and archive procedures: [DETAILS OR UNKNOWN]
   - Teams responsible for each process: [DETAILS]
   - International transfers or third-party processors: [DETAILS OR UNKNOWN]
   
   Produce:
   1. A plain-English policy suitable for staff and suppliers.
   2. A retention schedule with columns for record or data category, purpose, system or owner, retention trigger, proposed retention period, disposal method and reason for the period.
   3. Separate rules for routine deletion, legal holds, subject access requests, complaints, investigations, litigation, backups and archived data.
   4. A list of missing information and decisions that the business must make before approval.
   5. A list of every statement that needs checking against current ICO guidance, another regulator, a contract or a solicitor.
   
   Do not present the draft as legal advice, do not claim that a period is lawful merely because it is common practice, and do not create a retention period where the information is missing. Where a period cannot be determined, write [REQUIRES BUSINESS OR PROFESSIONAL DECISION].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.