The honest take. For a general-knowledge privacy question — “what is a DPIA?”, “roughly how does GDPR's storage-limitation principle work?” — a frontier general-purpose chatbot is genuinely good. It's fast, it explains clearly, and it's free: ChatGPT is a general-purpose AI chatbot from OpenAI with a free version anyone can use (TechCrunch, “ChatGPT: everything you need to know,” accessed 8 Aug 2026). If explaining a concept is all you need, use it. We mean that.
The difference shows up the moment the question stops being “what does the law say in general?” and becomes “what is the right answer for us, and can we prove we got there properly?” That's the moment an answer stops being enough and you need a record — one grounded in your own facts, refused when it can't be grounded, signed by a named person, and verifiable by someone who wasn't in the room.
What a general-purpose chatbot is great at
- Explaining concepts. Ask what a legitimate-interests assessment is, or the difference between a controller and a processor, and you'll get a clear, well-organised answer in seconds.
- First drafts of prose. A rough paragraph for an internal FAQ, a plain-language rewrite of a dense clause, a starting outline. Good raw material for a human to shape.
- Brainstorming. “What are the usual risks to think about when we start processing location data?” is exactly the kind of open prompt a chatbot handles well.
- Zero cost, zero setup. No procurement, no onboarding. For an occasional general question, that's hard to beat.
None of that is in dispute. If your privacy “programme” today is a few general questions a month, a chatbot is a reasonable tool and we'd rather tell you that than sell you something you don't need yet.
Where an answer stops being enough
A general-purpose chatbot is built to produce a fluent, plausible answer. It is not built to produce evidence. Those are different jobs, and privacy work — the kind a regulator, an auditor, a customer's security team, or your own board can later ask you to stand behind — is an evidence job. Five differences matter:
- Grounded in your facts, not the internet's. A chatbot answers from its general training. It doesn't know your vendor list, your retention schedule, or what your own privacy policy actually commits you to — unless you paste all of it in every time. Privacy Automated runs its answers through hybrid retrieval and a reranker over your uploaded policies and records, and cites only from a closed, curated statutory corpus; a validator rejects any citation id the model tries to invent.
- It refuses when it can't ground the answer. A chatbot will almost always produce something — even when it shouldn't. Our pipeline puts an independent grounding judge after the drafting model: a separate check whose only job is to refuse answers that aren't supported by your sources. Low-confidence or ungrounded results don't get dressed up as facts; they get routed to a human. (Full pipeline on the trust architecture page.)
- Statutory clocks come from a table, not model recall. Ask a chatbot for a DSAR deadline and it recalls a number from training — and sometimes recalls it wrong. Our deadlines are computed from a typed jurisdiction table with statute citations for each row (live counts served from our reference endpoint), not from what a model happens to remember.
- A named human signs off — and that's enforced, not encouraged. Under our Invariant 12, a determination or sign-off cannot be recorded without an authenticated, named human and a non-empty set of citations. That rule is enforced at the schema level by a database constraint, so an unsigned or uncited determination can't exist in the first place.
- The output is a sealed record a regulator can verify. The finished record is sealed and tamper-evident, with the audit chain naming the signing human, linking the AI draft, and pinning the prompt hash. Anyone — a regulator, an auditor, a customer — can confirm the record is authentic and untampered at app.privacyautomated.ai/verify with no account. (“Verify” here means the record is genuine and unaltered — not a judgement that your programme is compliant; that's still a human's call.)
A concrete example: “How long should we keep former customers' data?”
Same question, two tools. One returns an answer; the other returns something you could hand to a regulator.
A general-purpose chatbot
“It depends on the purpose. Under the GDPR storage-limitation principle you should keep personal data only as long as necessary. Many companies retain financial and tax records for around 6–7 years and delete other customer data sooner. You should define a retention period for each data category and document it. Consult a lawyer for your specific situation.”
Fluent, generally reasonable, and generic. It doesn't know your retention schedule, cites nothing you own, and leaves no record. If someone later asks “why 7 years, and who decided?”, there's nothing to point to.
Privacy Automated
“Per your Data Retention Schedule §4.2: customer account records are retained 7 years after account closure (tax/audit basis); marketing-profile data is deleted within 90 days of closure. This activity is recorded in your RoPA under Customer Accounts.”
Drawn from your own uploaded schedule and cited to the section. If your documents don't actually answer it, the grounding judge refuses rather than guesses and routes it to a person. Once a named human signs off, it's a sealed, verifiable record.
Illustrative. The chatbot column shows the kind of general answer a general-purpose chatbot returns; the Privacy Automated column assumes you've uploaded a retention schedule for the engine to ground in and cite.
Feature-by-feature
| Just asking a chatbot | Privacy Automated | |
|---|---|---|
| Explain a general privacy concept | Yes — fast and free | Yes |
| Grounded in your own vendor list & policies | No — unless you paste them in each time | Yes — retrieval + reranker over your docs |
| Refuses when it can't ground the answer | No — tends to answer anyway | Yes — independent grounding judge routes to a human |
| Cites only real statutory sources | Recalls sources; can invent citations | Closed corpus; validator rejects invented ids |
| Statutory deadline math | From model recall (can be wrong) | Computed from a typed jurisdiction table |
| Named-human sign-off | No concept of it | Required & schema-enforced (Invariant 12) |
| Sealed record a regulator can verify | No — produces a chat reply | Tamper-evident; verifiable at /verify, no account |
| Cost | Free / low | $0 (Free) / $99/mo (Starter) / $299/mo (Growth) |
When to pick which
Just ask a chatbot if: you want a concept explained, a rough draft to edit, or a quick sanity-check on general privacy vocabulary — and no one is going to ask you to prove, later, how you arrived at the answer. For that, a free general-purpose chatbot is a fine tool.
Use Privacy Automated if: the answer has to be right for your company and defensible after the fact — a DPIA on a new processing activity, a DSAR with a real statutory clock running, a retention or vendor question a customer or regulator might revisit. Anywhere you need a record instead of a reply, a chatbot's fluent answer is the beginning of the work, not the end of it.
The one-line version. A chatbot is a brilliant way to understand a privacy question. It is not a way to evidence your answer to one. When “we think this is right” has to become “here's the signed, cited, verifiable record showing it,” that's the line where a general-purpose chatbot ends and Privacy Automated begins.
Turn answers into records.
Free 14-day trial. Upload one policy, ask a real question about your own workflow, and see a grounded, cited, sign-off-ready answer instead of a chat reply.