Law note · United Kingdom
Data (Use and Access) Act 2025 Section 80, Automated Decision-Making, UK GDPR Articles 22A-22D
Before the DUA Act, UK General Data Protection Regulation (GDPR) Article 22, inherited unchanged from EU GDPR, generally prohibited a decision based solely on automated processing that produces legal or similarly significant effects, subject to narrow exceptions.
Section 80 of the DUA Act replaced Article 22 with four new articles, 22A to 22D, in force from 5 February 2026: solely automated significant decisions are now permitted generally, with the controller required to inform the individual in advance, provide a meaningful human review on request, and let the decision be contested.
The general prohibition now applies only where the automated processing relies entirely or partly on special category data or on the new recognised legitimate interests basis.
A related statutory duty, S.I. 2026/425 (made 16 April 2026, in force 12 May 2026), requires the ICO to prepare and publish a binding Code of Practice on AI and automated decision-making; the ICO's own non-binding draft guidance was under public consultation from 31 March to 29 May 2026, with the statutory Code itself not expected to take effect until 2027.
That still-unmade Code is recorded on this same row rather than as a separate instrument, since it exists specifically to implement this reform and does not yet have content of its own to describe.
What it asks of an app
- Before finalizing a solely automated decision producing legal or similarly significant effects for a person in the United Kingdom, inform them in advance, and provide a meaningful human review and a right to contest the decision on request, under UK General Data Protection Regulation (GDPR) Articles 22A to 22D.
- Where your automated decision-making relies on special category data or on the recognised legitimate interests basis, expect the general prohibition on solely automated significant decisions to still apply, rather than the DUA Act's general permission.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: legislation.gov.uk, official consolidated text
ICO ADM Code of Practice consultation materials