Home · Business · Customer Service · Help docs & FAQs

PARTLY

As of 13 August 2026, AI can only partly write a GDPR FAQ for your customers.

This still needs a person who signs their name to it.

Can you do it?

5 minutesto a draft.

2 hoursto something you’d act on.

Cost, all in£0

Skill neededchat-fluent

Who has to check ita professional

What the alternative costsA purpose-built alternative is CustomGPT, a no-code chatbot trained on your business content with citations.

If this goes wrong, customers receive an incorrect explanation of how you use their data and your organisation remains accountable for the published information.

What to actually do

  1. Hand it to a person

    The route this page recommends

    Someone with a licence or accountable authority has to sign this before it counts.

  2. Use a tool built for this

    Second choice

  3. Do it yourself

    The distant third

    A chat interface, chat-fluent skill, and roughly 2 hours until you can act on the result.

    How to actually do it

    1. Open your current privacy notice, cookie notice, data retention schedule, customer rights procedure and complaints process.
    2. Paste those documents into the prompt, adding your organisation name, service description and the correct privacy or data protection contact details.
    3. Ask the model to produce the FAQ and a separate list of missing facts, legal checks and statements requiring confirmation.
    4. Compare every factual answer with the source documents, including the purposes, lawful bases, recipients, retention periods, transfers and contact details.
    5. Check the legal wording and any rights explanation against current ICO guidance, and ask your data protection lead or data protection solicitor to resolve anything unclear.
    6. Remove every [FACT NEEDED] marker, correct the approved answers, and send the final FAQ through your normal publication approval process.

    Prompt

    Write a customer-facing GDPR FAQ for a UK organisation using only the source material below. Cover the questions customers are most likely to ask about what personal data we collect, why we use it, our lawful basis where stated, who receives it, international transfers where stated, retention, customer rights, cookies or similar technologies where stated, how to contact us, and how to complain. Use plain British English, short answers and headings. Do not invent facts, legal bases, retention periods, recipients, safeguards, contact details or customer rights. If the source material does not answer a question, write [FACT NEEDED] and list the missing fact separately. Distinguish clearly between information about our actual practices and general legal information. Do not give an individual diagnosis or legal conclusion. Mark any answer that needs checking against current ICO guidance or by our data protection lead. Include this note for internal review: not professional advice. Add a final list of every statement that must be checked before publication. Organisation: [NAME]. Website or service: [DESCRIPTION]. Source material: [PASTE PRIVACY NOTICE, DATA HANDLING PROCEDURES, COOKIE INFORMATION, CUSTOMER CONTACT DETAILS AND COMPLAINTS PROCESS].

    Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.

What it gets wrong

  • AI cannot establish whether your stated lawful basis is correct for the processing you actually carry out.
  • AI cannot know your real data flows, suppliers, retention periods or international transfer arrangements unless you provide and maintain them.
  • AI cannot take responsibility for an inaccurate privacy explanation published by your organisation.
  • AI cannot replace a data protection lead or solicitor when the answer depends on a disputed interpretation or a serious compliance risk.

What caps this at PARTLY: legal accountability, regulated advice and verification cost.

How we scored this

Five axes, each scored nought to two by hand: ten means AI carries the task cleanly, and the thresholds that turn a total into YES, PARTLY or NO are published in the methodology. Each axis name links to its definition.

AxisScore (0–2)
Output2
Inputs1
Verification1
Liability1
Effort delta2
Total7 / 10

The methodology and its thresholds are published in full.

FAQ

Can ChatGPT write a GDPR FAQ?
Yes, it can produce a clear first draft from your privacy notice and internal procedures. It cannot confirm that your processing, lawful bases or retention periods are legally correct, so a responsible person must check the draft before publication.
Is it safe to use AI for GDPR information?
It is suitable for drafting and simplifying information that you have already checked. Do not paste customer personal data into a general chatbot, and treat the output as not professional advice.
What information does AI need to write a GDPR FAQ?
Give it your current privacy notice, cookie information, data handling procedures, retention schedule, customer rights process, complaints route and approved contact details. It also needs accurate information about suppliers, data transfers and the purposes for which your organisation uses personal data.
Who should check a GDPR FAQ before I publish it?
Your data protection lead should check the facts and operational process, with a data protection solicitor handling a serious or disputed legal case. Your organisation remains responsible for what it publishes, even when AI wrote the first draft.

Nearby answers

All Help docs & FAQs rulings

Assessed by gpt-5.6-luna (gpt-5.6-luna) on 2026-08-13, second-checked by an independent model. Wrong somewhere? Email [email protected] and it gets re-checked.

The newsletter

AI news, new answers and product picks, straight to your inbox.