United KingdomData (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22D
Data (Use and Access) Act 2025, c. 18, §80 (new UK GDPR Arts. 22A-22D); S.I. 2026/425
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Governance
- Audit expectation
- none
What it requires
- Where you take a significant decision about a person in the United Kingdom based solely on automated processing of their personal data, have safeguards in place that give them information about the decision, let them make representations about it, let them obtain human intervention, and let them contest it, under UK General Data Protection Regulation (GDPR) Article 22C.NIST Privacy FrameworkCT.DM-P10
- Do not take a significant decision based solely on automated processing where your processing for it relies in any part on the recognised legitimate interests basis in UK GDPR Article 6(1)(ea), and base one on special category data only with the person's explicit consent, or where it is necessary for a contract or required or authorised by law and the Article 9(2)(g) substantial public interest condition applies, under UK GDPR Article 22B.NIST Privacy FrameworkCT.DM-P10NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
UK GDPR Art. 83(5)(ba), inserted by the Data (Use and Access) Act 2025 (Sch. 6 para. 9(b), commenced by S.I. 2026/82), puts an infringement of the new Articles 22B or 22C automated-decision-making safeguards under the higher maximum amount: the higher of £17,500,000 or 4% of worldwide annual turnover (DPA 2018 s.157(5)).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, the UK's single supervisory authority for data protection and PECR, exercising the Article 57 tasks and Article 58 powers conferred on it by Data Protection Act 2018 s.115.
Enforcement record
Hand count from the ICO's own enforcement action register (Type facet Monetary penalties plus Enforcement notices), read across the register's first two pages (50 of 222 total listed actions of every type), which cover back to , past the twelve-month cutoff. In the twelve months ending (the register's most recent entry), the ICO published 18 monetary penalty notices and 14 enforcement notices, for a combined 32 actions. Reprimands and prosecutions are excluded. Where the register lists a monetary penalty notice and an enforcement notice against the same underlying matter as two separate rows (for example Elderly Aids Limited, ), each row counts once as its own published enforcement instrument. Several monetary penalty rows in the register's list view state no penalty figure in the summary text shown there (only the full decision notice states it), so a sum from the visible list would understate the true total. This is the ICO's enforcement record for the data protection and PECR regime generally, not a record specific to this instrument's own provisions.
- As of
- Source link
- https://ico.org.uk/action-weve-taken/enforcement/
- Actions per year
- 32
Settledness
The Information Commission’s updated guidance on automated decision-making under Articles 22A to 22D is a draft still out for consultation.
- As of
- Open questions
- Does a decision involve "meaningful human involvement" where a person reviews the output of a profiling system before it is acted on, given that Article 22A(2) makes the extent to which the decision is reached by means of profiling a factor in that assessment?
What it makes you log
Logging duty
Articles 22A to 22D define a significant decision based solely on automated processing, restrict it for special category data and where the recognised legitimate interests basis is used, and require safeguards that give the person information, a chance to make representations, human intervention and a way to contest. Those are measures for the data subject, and none of them requires the controller to keep a log or record; Article 22D only lets the Secretary of State add safeguard requirements by regulations.
- Kind
- None
- As of
What this law does
Before the DUA Act, UK GDPR Article 22, inherited unchanged from EU GDPR, generally prohibited a decision based solely on automated processing that produces legal or similarly significant effects, subject to narrow exceptions.
Section 80 of the DUA Act replaced Article 22 with four new articles, 22A to 22D, in force from : a significant decision based solely on automated processing of personal data is now generally permitted, provided the controller has safeguards in place that give the individual information about such decisions taken about them and let them make representations, obtain human intervention, and contest the decision.
Restrictions remain in two cases: a decision based entirely or partly on special category data needs the individual's explicit consent, or must be necessary for a contract or required or authorised by law with the Article 9(2)(g) substantial public interest condition met, and no such decision may be taken where the processing relies entirely or partly on the new recognised legitimate interests basis.
A related statutory duty, S.I. 2026/425 (made , in force ), requires the Information Commissioner to prepare a code of practice giving guidance on good practice in developing and using AI and in automated decision-making, including for children's personal data. Under section 127 of the Data Protection Act 2018 a court or tribunal must take such a code into account where it is relevant, but failing to follow it does not of itself make a person liable.
The ICO's own non-binding draft guidance was under public consultation from 31 March to . The Information Commission took over the Information Commissioner's functions on . That still-unmade Code is recorded on this same row rather than as a separate instrument, since it exists specifically to implement this reform and does not yet have content of its own to describe.
UK GDPR's own definition of 'controller', now at Article 4(1)(7) following the DUA Act's renumbering of Article 4, names a public authority, agency or other body on the same footing as a natural or legal person, so these Articles 22A to 22D automated decision-making duties bind a government body exactly as they bind a private one.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .