As of 13 August 2026, AI cannot write a GDPR-compliant data protection clause.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open the contract and the latest relevant UK ICO guidance, then identify whether each party is acting as a controller, processor or independent controller for each processing activity.
   2. Gather the processing purpose, duration, personal data categories, data subject categories, locations, international transfers, subprocessors, security measures and deletion requirements from your contract, records and supplier information.
   3. Paste only the relevant contract text and those confirmed facts into the prompt, marking every unknown item as unknown rather than asking the model to fill it in.
   4. Ask the model to produce the missing-facts list, its role assumption, the draft clause and the solicitor-check checklist in that order.
   5. Compare every factual statement in the draft against your contract, records of processing, supplier terms, transfer arrangements and security documentation, and replace unsupported statements with bracketed placeholders.
   6. Send the draft, the original contract and the model's missing-facts list to a UK solicitor or data protection specialist for confirmation before signing or relying on the clause.

   Prompt

   Act as a drafting assistant, not a solicitor. Draft a UK data protection schedule or clause for the contract described below, using the UK GDPR and the Data Protection Act 2018 as the legal context. Do not claim that the result is compliant or ready to sign. First list the facts that are missing or ambiguous, then produce a clearly labelled draft using bracketed placeholders for anything not supplied. Cover the parties' roles, the documented processing instructions, purpose, duration, data categories, data subject categories, confidentiality, security measures, personal data breach assistance, rights-request assistance, privacy impact assessment and regulator assistance, deletion or return of data, audit and information rights, subprocessors, international transfers, and allocation of responsibilities. Distinguish controller-to-processor wording from independent-controller wording and say which assumption the draft uses. Do not invent processing activities, security measures, transfer arrangements, deadlines or legal conclusions. Add a short checklist of points a UK solicitor or data protection specialist must confirm before signature. Contract details: [paste the relevant contract or describe it]. Parties and roles: [insert]. Processing purpose and duration: [insert]. Personal data and data subjects: [insert]. Locations and transfers: [insert]. Subprocessors: [insert]. Security measures: [insert]. Commercial requirements and governing law: [insert].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.