United KingdomData (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22D
Data (Use and Access) Act 2025, c. 18, §80 (new UK GDPR Arts. 22A-22D); S.I. 2026/425
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force 8 months, effective 5 February 2026.
A data subject rights rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Before finalizing a solely automated decision producing legal or similarly significant effects for a person in the United Kingdom, inform them in advance, and provide a meaningful human review and a right to contest the decision on request, under UK General Data Protection Regulation (GDPR) Articles 22A to 22D.
- Where your automated decision-making relies on special category data or on the recognised legitimate interests basis, expect the general prohibition on solely automated significant decisions to still apply, rather than the DUA Act's general permission.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
UK GDPR Art. 83(5)(ba), inserted by the Data (Use and Access) Act 2025 (Sch. 6 para. 9(b), commenced 5 February 2026 by S.I. 2026/82), puts an infringement of the new Articles 22B or 22C automated-decision-making safeguards under the higher maximum amount: the higher of £17,500,000 or 4% of worldwide annual turnover (DPA 2018 s.157(5)).
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commissioner's Office (ICO), the UK's single supervisory authority for data protection and PECR, exercising the Article 57 tasks and Article 58 powers conferred on the Commissioner by Data Protection Act 2018 s.115.
Enforcement record
Hand count from the ICO's own enforcement action register (Type facet Monetary penalties plus Enforcement notices), read across the register's first two pages (50 of 222 total listed actions of every type), which cover 7 August 2026 back to 24 April 2025, past the twelve-month cutoff. In the twelve months ending 7 August 2026 (the register's most recent entry), the ICO published 18 monetary penalty notices and 14 enforcement notices, for a combined actions_per_year of 32. Reprimands and prosecutions are excluded. Where the register lists a monetary penalty notice and an enforcement notice against the same underlying matter as two separate rows (for example Elderly Aids Limited, 6 August 2026), each row counts once as its own published enforcement instrument. fines_per_year is omitted: several monetary penalty rows in the register's list view state no penalty figure in the summary text shown there (only the full decision notice states it), so a sum from the visible list would understate the true total. This is the ICO's enforcement record for the data protection and PECR regime generally, not a record specific to this instrument's own provisions.
- As of
- 2 September 2026
- Source link
- https://ico.org.uk/action-weve-taken/enforcement/
- Actions per year
- 32
What it reaches
Obligation class
Data subject rights, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Before the DUA Act, UK GDPR Article 22, inherited unchanged from EU GDPR, generally prohibited a decision based solely on automated processing that produces legal or similarly significant effects, subject to narrow exceptions.
Section 80 of the DUA Act replaced Article 22 with four new articles, 22A to 22D, in force from 5 February 2026: solely automated significant decisions are now permitted generally, with the controller required to inform the individual in advance, provide a meaningful human review on request, and let the decision be contested.
The general prohibition now applies only where the automated processing relies entirely or partly on special category data or on the new recognised legitimate interests basis. A related statutory duty, S.I. 2026/425 (made 16 April 2026, in force 12 May 2026), requires the ICO to prepare and publish a binding Code of Practice on AI and automated decision-making. The ICO's own non-binding draft guidance was under public consultation from 31 March to 29 May 2026.
That still-unmade Code is recorded on this same row rather than as a separate instrument, since it exists specifically to implement this reform and does not yet have content of its own to describe.
UK GDPR's own definition of 'controller', now at Article 4(1)(7) following the DUA Act's renumbering of Article 4, names a public authority, agency or other body on the same footing as a natural or legal person, so these Articles 22A to 22D automated decision-making duties bind a government body exactly as they bind a private one.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisions
Read the law
legislation.gov.uk, official consolidated text
ICO ADM Code of Practice consultation materials
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.