Automated Decision-Making: Significant Decisions Based Solely on Automated Processing (UK GDPR Articles 22A to 22D)

Data (Use and Access) Act 2025, c. 18, s. 80, substituting Articles 22A to 22D into the UK GDPR

In force since 5 Feb 2026.

An AI risk obligations rule binding public and private bodies.

Obligation class: Data subject rights, Disclosure
Audit expectation: none
Setting the rule reaches: General

As of 3 November 2026.

What it requires

Where you take a significant decision about a person, one with a legal effect or a similarly significant effect, based solely on automated processing of their personal data, have safeguards in place that give the person information about the decision, let them make representations, let them obtain human intervention from you and let them contest the decision.
Do not take a significant decision based entirely or partly on special category personal data solely by automated processing unless the decision is based entirely on processing to which the person has given explicit consent, or the decision is necessary for entering into or performing a contract with the person, or is required or authorised by law, and point (g) of Article 9(2) applies.
Do not take a significant decision solely by automated processing where the processing of personal data for the decision is carried out entirely or partly in reliance on Article 6(1)(ea).

These lines are LexLint's reading of the law's text, as of 3 November 2026.

What it makes you log

Logging duty

Articles 22A to 22D set the conditions for solely automated significant decisions and the safeguards that must accompany them; none of them requires a controller to keep or produce a log or record of the decisions.

Kind: None
As of: 3 November 2026

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 80 of the Data (Use and Access) Act 2025 replaces Article 22 of the UK GDPR with Articles 22A to 22D. A decision is based solely on automated processing where there is no meaningful human involvement in taking it, and it is a significant decision where it produces a legal effect for the person or a similarly significant effect.

A significant decision that rests entirely or partly on special category personal data may not be taken solely by automated processing unless the decision is based entirely on processing to which the person has given explicit consent, or the decision is necessary for entering into or performing a contract with the person, or is required or authorised by law, and point (g) of Article 9(2) applies.

Where a controller takes a significant decision based solely on automated processing that uses personal data, it must have safeguards that give the person information about the decision, let them make representations, let them obtain human intervention and let them contest the decision. The Secretary of State may make regulations on what counts as meaningful human involvement and a similarly significant effect, and on further safeguards.

When LexLint raises it

When your app profile says your app makes high-risk automated decisions.

Back to the example · Lint your app