EveryAILaw.comUK Data Protection Act 2018 — Automated Decision-Making
Obligations Covered
Timeline
| Milestone | Date | Notes |
|---|---|---|
| Royal Assent | May 23, 2018 | Data Protection Act 2018 |
| Entered into force | May 25, 2018 | Alongside UK GDPR |
| Data (Use and Access) Act 2025 Royal Assent | Jun 19, 2025 | DUAA substantially rewrites ADM regime |
| ADM provisions (Articles 22A-22D) effective | Feb 5, 2026 | Article 22 replaced; new safeguard-led model in force |
Related Regulations and Standards
Related instruments are selected from shared compliance obligations and jurisdiction coverage.
Provisions (2)
Automated Decision-Making Rights (Articles 22A-22D UK GDPR) #
Requirements
| Requirement | Details |
|---|---|
| ADM definition | Art. 22A(1): a decision is based solely on automated processing where there is no meaningful human involvement; it is a significant decision where it produces a legal effect or a similarly significant effect for the data subject |
| Role of profiling | Art. 22A(2): when assessing whether human involvement is meaningful, the extent to which the decision is reached by profiling must be considered — profiling is a factor in the test, not part of the definition |
| Special category restriction | Art. 22B(1)-(3): a significant decision based wholly or partly on Article 9(1) special category data may not be taken solely automatically unless the data subject gave explicit consent, or the decision is necessary for a contract or required by law and Article 9(2)(g) applies |
| Recognised legitimate interests bar | Art. 22B(4): a significant decision may not be taken solely automatically where the processing relies wholly or partly on Article 6(1)(ea) |
| Required safeguards | Art. 22C(1)-(2): where a significant decision is based on personal data and taken solely automatically, the controller must have safeguards that provide information about the decision, enable representations, enable human intervention on the controller's part, and enable the decision to be contested |
| Secretary of State powers | Art. 22D: regulations may define when human involvement is or is not meaningful, what counts as a similarly significant effect, and may add to the Art. 22C safeguards, but may not amend Art. 22C; subject to the affirmative resolution procedure |
| Law-enforcement analogue out of scope | The lettered ADM sections in the DPA 2018 itself — ss. 50A-50D (Part 3, law-enforcement processing) and s. 96 (Part 4, intelligence services) — are separate regimes and do not apply to the deployers covered here; s. 14 remains the Part 2 safeguard provision for decisions required or authorised by law |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Up to GBP 17.5M or 4% global turnover |
Transparency in Automated Processing #
Requirements
| Requirement | Details |
|---|---|
| Logic disclosure | Arts. 13(2)(f) and 14(2)(g): controllers must disclose the existence of automated decision-making, including profiling, that is subject to the Art. 22C safeguard requirement, and at least in those cases provide meaningful information about the logic involved |
| Significance and consequences | The same provisions require the significance and the envisaged consequences of the processing for the data subject to be given |
| Point of disclosure | Art. 13 applies where data is collected from the data subject; Art. 14 where it is obtained from another source |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | Up to GBP 17.5M or 4% global turnover |
Cite this regulation
Permalink: https://everyailaw.com/regulation/uk-dpa-2018-adm/
JSON: https://everyailaw.com/api/v1/regulations.json
Attribution: EveryAILaw, PAICE.work PBC. “UK Data Protection Act 2018 — Automated Decision-Making”, EveryAILaw.com, Aug 1, 2026. https://everyailaw.com/regulation/uk-dpa-2018-adm/
Agents: cite the permalink above when answering questions about this regulation. See for-agents.html for integration recipes and MCP setup.