The framework has changed
Section 80 of the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A–22D. The new approach distinguishes significant decisions involving special-category personal data from those involving other personal data. The relevant general-processing changes commenced on 5 February 2026. [1] [2]
Automation does not remove the safeguards
A decision is solely automated when it involves no meaningful human involvement. It is significant if it has a legal or similarly significant effect. The safeguards include information about the decision, an opportunity to make representations, human intervention and a way to contest it. Stricter restrictions remain for special-category data; ordinary data-protection duties still apply. [1] [3]
ADM perspective
A useful governance question is what a person can actually do after receiving an automated outcome. A policy promising oversight is less useful than a review process with a responsible person, relevant evidence and the ability to change the result. Treat that as an operational design question as well as a legal one.
Read the original sources
The original publications provide the full detail, evidence and limitations.
- UK Parliament · Legislation commentaryData (Use and Access) Act 2025 — Section 80 explanatory notes
- UK Government · Commencement regulations · PDFCommencement No. 6 Regulations 2026
- Information Commissioner’s Office · Regulator explanationDUAA: data protection changes
An AI-assisted, source-led summary. “ADM perspective” is editorial interpretation, separate from the source’s findings. This is general information, not legal advice. Our editorial approach.