# Automated decisions: what UK GDPR now requires

Check what a system decides, who reviews it and how someone can challenge the result.

The Assurance Desk. Published 9 October 2026. Last checked 9 October 2026.

Part of the guide [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md).

**The short answer.** Under UK GDPR, significant decisions made without meaningful human involvement need safeguards. Decisions using sensitive information face extra restrictions. A valid legal basis is still needed for using personal data ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/6), checked 9 October 2026).

## When does an automated decision need these safeguards?

The automated decision test looks at human involvement and the effect on the person. Is there meaningful human involvement in taking the decision? Does the decision have a legal effect, or a similarly significant effect, on the person? Both matter ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

Consider this fictional recruitment example. A tool sorts applications for a manager to review. In another process, it rejects applicants without anyone considering their cases. Ask who actually makes each decision and how it affects the applicant. The fact that software is involved does not answer those questions ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

The extent of profiling also matters when judging human involvement. Look at how the decision is reached, rather than simply whether a person clicked a button ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

**Check both parts of the decision**

Is the decision significant and solely automated?

- No meaningful human involvement: for example, Consider who takes the decision and what the human review actually changes.

AND

- A legal or similarly significant effect: for example, Consider the effect on the person, not just the technology used.

Both apply: check the restrictions and put the safeguards in place.
One does not apply: this particular test is not met. A legal basis for using personal data is still needed.

Both conditions below must be met. These are the legal tests, not a verdict on a particular tool.

Source: legislation.gov.uk, Data (Use and Access) Act 2025, https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 9 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/6 (checked 9 October 2026)

## What changed in the UK?

The new UK rules took effect on 5 February 2026. They replaced the former automated decision provision. Some earlier decisions remain covered by the old safeguards ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), [legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made) and [legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/82/regulation/5/made), checked 9 October 2026).

The ICO still lists its updated automated decision guidance as being drafted. The consultation has closed and the final version is expected in winter 2026. A consultation draft should not be described as final guidance ([ICO, Technology](https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-guidance/technology/), checked 9 October 2026).

## What if the decision uses sensitive information?

Special category data includes information about health or sex life. If any of that information feeds a significant, solely automated decision, an extra restriction applies ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/9), checked 9 October 2026).

One route requires explicit consent for all the personal data processing on which the decision is based. The other requires contract necessity or a decision required or authorised by law, together with the substantial public interest condition ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

That public interest condition needs an appropriate basis in law, proportionality and suitable safeguards. Contract necessity alone does not satisfy this second route ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/9), checked 9 October 2026).

**The special category restriction: two possible routes**

| Route | What must be true |
| --- | --- |
| Explicit consent | All personal data processing on which the decision is based has the person’s explicit consent. |
| Contract or legal route, plus public interest | The decision is necessary for entering into or performing a contract, or required or authorised by law. The substantial public interest condition must also apply. |

Source: legislation.gov.uk, Data (Use and Access) Act 2025, https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 9 October 2026); legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance), https://www.legislation.gov.uk/eur/2016/679/article/9 (checked 9 October 2026)

## Which legal basis can you use?

Every use of personal data needs a valid legal basis. There is also a specific bar here: significant, solely automated decisions cannot rely wholly or partly on recognised legitimate interests ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/6), checked 9 October 2026).

Recognised legitimate interests is a separate basis from ordinary legitimate interests. The latter has its own balancing test. Do not treat the shared words as making them interchangeable ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/6), checked 9 October 2026).

## What safeguards must people have?

For a significant decision based on personal data and taken solely by automated processing, people need information, a way to put their case, human intervention and a way to contest the result ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

The examples below show what to plan for. They are possible ways to provide the safeguards, not a complete design for every system ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

**Safeguards, with illustrative ways to provide them**

| Safeguard | A practical example |
| --- | --- |
| Information about the decision | Explain the decision to the person in clear words. |
| A way to put their case | Provide a route to send relevant information or explain why something is wrong. |
| Human intervention | Route the case to a person who can review it. |
| A way to contest the decision | Explain how to challenge the result and where that challenge goes. |

Source: legislation.gov.uk, Data (Use and Access) Act 2025, https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 9 October 2026)

## What should be checked before launch?

If the planned use of personal data is likely to create a high risk to people, an impact assessment is required before it starts. This examines the need for the processing, its risks and the measures to address them ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/35), checked 9 October 2026).

A useful practical check is to walk through a challenge as if you were the person affected. Can you find the explanation, add information and reach a human reviewer? This tests the routes the safeguards require ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

Eduardo Ustaran makes a broader point about trusted AI: rules and practical governance both matter. His comment is an expert view, rather than the legal test for a particular decision ([Eduardo Ustaran on LinkedIn](https://www.linkedin.com/posts/eduardoustaran_a-bit-of-food-for-thought-for-the-weekend-activity-7471252198191124481-6eTc), checked 9 October 2026).

> "Both realistic regulation and effective governance practices are essential for AI to be trusted."
> Eduardo Ustaran, LinkedIn post excerpt
> Eduardo Ustaran on LinkedIn, AI Regulation and Governance for Trust, Eduardo Ustaran posted on the topic, https://www.linkedin.com/posts/eduardoustaran_a-bit-of-food-for-thought-for-the-weekend-activity-7471252198191124481-6eTc (checked 9 October 2026)
> [View LinkedIn post](https://www.linkedin.com/posts/eduardoustaran_a-bit-of-food-for-thought-for-the-weekend-activity-7471252198191124481-6eTc)

## What to do

1. Describe the decision and its effect on the person ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).
2. Check what meaningful human involvement takes place ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).
3. Identify the legal basis and whether special category information is involved ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/6) and [legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/9), checked 9 October 2026).
4. Check that all the safeguards work in practice ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).
5. Assess likely high risks before starting the processing ([legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance)](https://www.legislation.gov.uk/eur/2016/679/article/35), checked 9 October 2026).

## Common questions

### Does a human clicking approve make a decision human?

The test is meaningful human involvement in taking the decision. A button click alone does not show what judgement that person exercised ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

### Does every use of AI fall under these rules?

These safeguards concern significant decisions based on personal data and taken without meaningful human involvement. Check the decision and its effect, rather than starting with the AI label ([legislation.gov.uk, Data (Use and Access) Act 2025](https://www.legislation.gov.uk/ukpga/2025/18/section/80), checked 9 October 2026).

### What about decisions made before the change?

Specified decisions taken before 5 February 2026 keep the former safeguards. The saving covers decisions to which the previous automated decision safeguard provisions applied. Check the original decision and the relevant provision ([legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026](https://www.legislation.gov.uk/uksi/2026/82/regulation/5/made), checked 9 October 2026).

## Where next

- [Is UK GDPR changing in 2026?](https://theassurancedesk.com/guides/uk-gdpr-changes-data-use-and-access-act.md)
- [A DPIA for an AI tool: when and how](https://theassurancedesk.com/guides/dpia-for-an-ai-tool.md)
- [What must your UK privacy notice say?](https://theassurancedesk.com/guides/what-your-privacy-notice-must-say.md)
- [AI agents: what to check before they act](https://theassurancedesk.com/guides/ai-agents-permissions-and-approvals.md)
- [UK GDPR versus EU GDPR: which rules apply?](https://theassurancedesk.com/guides/uk-gdpr-vs-eu-gdpr.md)

## Sources

- legislation.gov.uk, Data (Use and Access) Act 2025: https://www.legislation.gov.uk/ukpga/2025/18/section/80 (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/6 (checked 9 October 2026)
- legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026: https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made (checked 9 October 2026)
- legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026: https://www.legislation.gov.uk/uksi/2026/82/regulation/5/made (checked 9 October 2026)
- ICO, Technology: https://ico.org.uk/about-the-ico/what-we-do/our-plans-for-new-and-updated-guidance/technology/ (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/9 (checked 9 October 2026)
- legislation.gov.uk, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) (Text with EEA relevance): https://www.legislation.gov.uk/eur/2016/679/article/35 (checked 9 October 2026)
- Eduardo Ustaran on LinkedIn: https://www.linkedin.com/posts/eduardoustaran_a-bit-of-food-for-thought-for-the-weekend-activity-7471252198191124481-6eTc (checked 9 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.