As of 13 August 2026, AI cannot write your UK GDPR privacy notice.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface gets you a draft, but you cannot verify it yourself. That is the catch.

   How to actually do it

   1. Open a blank document and collect your organisation's legal name, registered or trading address, privacy contact, data protection officer details if applicable, and ICO complaint information.
   2. List every group of people whose data you process, such as customers, staff, applicants, website visitors and suppliers, then list the data collected and where it comes from for each group.
   3. For each processing purpose, record the lawful basis already approved by your organisation, the recipients, any international transfers, safeguards, retention period, profiling or automated decisions, and whether providing the data is required.
   4. Paste only those verified facts into the copyable prompt, including your website, app, form and other collection points, and ask the chatbot to identify missing facts before drafting.
   5. Copy the draft into your document and compare every statement with your actual systems, contracts, records of processing, retention schedule, supplier list and international transfer arrangements.
   6. Send the facts, the draft and the chatbot's unresolved-issues list to a UK data protection solicitor or qualified data protection specialist, then publish the approved notice at each point where personal data is collected.

   Prompt

   Draft a UK GDPR privacy notice for [ORGANISATION NAME], a [TYPE OF ORGANISATION] based in [LOCATION]. Use only the facts I provide and do not invent any processing activity, legal basis, retention period, recipient, international transfer, cookie use or contact detail. Write in clear UK English for the people whose data we process. Cover, where applicable: who the controller is and how to contact it; what personal data we collect; where it comes from; why we use it; the lawful basis for each purpose; who receives it; international transfers and safeguards; how long we keep each category of data; individual rights and how to exercise them; the right to complain to the Information Commissioner's Office; whether providing data is required and what happens if it is not provided; automated decision-making or profiling; and how we update the notice. First list every missing fact or unresolved legal decision under clear headings. Then produce the draft with a table mapping each processing purpose to the data used, lawful basis, recipients and retention period. Mark anything that needs confirmation by a UK data protection solicitor or qualified data protection specialist. Do not state that the notice is compliant unless a professional has checked it. Here are the facts: [PASTE YOUR VERIFIED BUSINESS INFORMATION HERE].

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.