Since 5 February 2026, the UK’s rules on automated decisions have been those in new Articles 22A to 22D of the UK GDPR, inserted by the Data (Use and Access) Act 2025. The old near-prohibition has gone. In its place is a permission with conditions, and the conditions are specific enough that a board can check them.
What counts
The rules apply to a significant decision, one with a legal or similarly significant effect on a person, taken solely by automated processing. The Act defines “solely” as meaning there is no meaningful human involvement. A person who clicks “approve” on whatever the system recommends is unlikely to count.
The four safeguards
Where you make such decisions using personal data, Article 22C requires measures that:
- give the person information about the decisions taken about them;
- let them make representations about those decisions;
- let them obtain human intervention from you;
- let them contest the decision.
Decisions that rely on special category data are more restricted still: broadly, they need explicit consent, or must be necessary for a contract or required by law with a substantial public interest condition.
Where this bites in practice
- Screening job applications or ranking candidates with a tool nobody reviews properly.
- Automated credit, pricing or eligibility decisions in customer journeys.
- AI features switched on inside HR, finance or case-management systems, often without anyone deciding they should be.
The difficulty is rarely the rule. It is knowing which decisions are automated in the first place. That is the same inventory our Copilot readiness check and AI acceptable use policy template start from.
The question your board should ask
“Which decisions about people do we now make with no meaningful human involvement, and for each one, could a person find out, object, and reach a human who can change the answer?”
If nobody can list them, that list is the first job. We never assess work we have advised on, and we never sell the fix for anything we assess. The first conversation is free.
Checked on 30 September 2026 against legislation.gov.uk (Data (Use and Access) Act 2025, section 80, and SI 2026/82). This is not legal advice.