Automated decisions: what UK GDPR now requires

Part of the guide Is UK GDPR changing in 2026?

When does an automated decision need these safeguards?

The automated decision test looks at human involvement and the effect on the person. Is there meaningful human involvement in taking the decision? Does the decision have a legal effect, or a similarly significant effect, on the person? Both matter.

Consider this fictional recruitment example. A tool sorts applications for a manager to review. In another process, it rejects applicants without anyone considering their cases. Ask who actually makes each decision and how it affects the applicant. The fact that software is involved does not answer those questions.

The extent of profiling also matters when judging human involvement. Look at how the decision is reached, rather than simply whether a person clicked a button.

Check both parts of the decision

Is the decision significant and solely automated?

No meaningful human involvement For example: Consider who takes the decision and what the human review actually changes.
and A legal or similarly significant effect For example: Consider the effect on the person, not just the technology used.

Both apply: check the restrictions and put the safeguards in place.

One does not apply: this particular test is not met. A legal basis for using personal data is still needed.

Both conditions below must be met. These are the legal tests, not a verdict on a particular tool.

What changed in the UK?

The new UK rules took effect on 5 February 2026. They replaced the former automated decision provision. Some earlier decisions remain covered by the old safeguards.

The ICO still lists its updated automated decision guidance as being drafted. The consultation has closed and the final version is expected in winter 2026. A consultation draft should not be described as final guidance.

What if the decision uses sensitive information?

Special category data includes information about health or sex life. If any of that information feeds a significant, solely automated decision, an extra restriction applies.

One route requires explicit consent for all the personal data processing on which the decision is based. The other requires contract necessity or a decision required or authorised by law, together with the substantial public interest condition.

That public interest condition needs an appropriate basis in law, proportionality and suitable safeguards. Contract necessity alone does not satisfy this second route.

The special category restriction: two possible routes
Route	What must be true
Explicit consent	All personal data processing on which the decision is based has the person’s explicit consent.
Contract or legal route, plus public interest	The decision is necessary for entering into or performing a contract, or required or authorised by law. The substantial public interest condition must also apply.

Which legal basis can you use?

Every use of personal data needs a valid legal basis. There is also a specific bar here: significant, solely automated decisions cannot rely wholly or partly on recognised legitimate interests.

Recognised legitimate interests is a separate basis from ordinary legitimate interests. The latter has its own balancing test. Do not treat the shared words as making them interchangeable.

What safeguards must people have?

For a significant decision based on personal data and taken solely by automated processing, people need information, a way to put their case, human intervention and a way to contest the result.

The examples below show what to plan for. They are possible ways to provide the safeguards, not a complete design for every system.

Safeguards, with illustrative ways to provide them
Safeguard	A practical example
Information about the decision	Explain the decision to the person in clear words.
A way to put their case	Provide a route to send relevant information or explain why something is wrong.
Human intervention	Route the case to a person who can review it.
A way to contest the decision	Explain how to challenge the result and where that challenge goes.

What should be checked before launch?

If the planned use of personal data is likely to create a high risk to people, an impact assessment is required before it starts. This examines the need for the processing, its risks and the measures to address them.

A useful practical check is to walk through a challenge as if you were the person affected. Can you find the explanation, add information and reach a human reviewer? This tests the routes the safeguards require.

Eduardo Ustaran makes a broader point about trusted AI: rules and practical governance both matter. His comment is an expert view, rather than the legal test for a particular decision.

Both realistic regulation and effective governance practices are essential for AI to be trusted.

What to do

Describe the decision and its effect on the person.
Check what meaningful human involvement takes place.
Identify the legal basis and whether special category information is involved.
Check that all the safeguards work in practice.
Assess likely high risks before starting the processing.

Common questions

Does a human clicking approve make a decision human?

The test is meaningful human involvement in taking the decision. A button click alone does not show what judgement that person exercised.

Does every use of AI fall under these rules?

These safeguards concern significant decisions based on personal data and taken without meaningful human involvement. Check the decision and its effect, rather than starting with the AI label.

What about decisions made before the change?

Specified decisions taken before 5 February 2026 keep the former safeguards. The saving covers decisions to which the previous automated decision safeguard provisions applied. Check the original decision and the relevant provision.

Where next

Sources

This is an independent editorial guide, not legal advice.