Rules / United Kingdom

Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making

In forceLawBinding

Replaces UK GDPR Article 22 with new Articles 22A-22D: solely automated decisions with legal or similarly significant effects are broadly permitted on any lawful basis if safeguards apply (information, ability to contest, human intervention), while stricter limits remain for special-category data. Applies to all controllers using automated decision-making, including AI.

Why it matters

Since 5 Feb 2026 UK organisations can rely on legitimate interests for significant automated decisions, but must provide notice, human review and a route to challenge.

What it requires

Human oversightTransparency to usersData governance

Penalties

UK GDPR maximum: GBP 17.5 million or 4% of worldwide turnover.

Sourcelegislation.gov.uk (SI 2026/82): https://www.legislation.gov.uk/uksi/2026/82/madeSecondary: https://www.legislation.gov.uk/ukpga/2025/18/contents Checked against the source on 4 Oct 2026. Section 80 commenced 5 Feb 2026 by the Commencement No. 6 Regulations (SI 2026/82), with saving provisions for decisions taken before that date.

Cite this record

Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. UK Parliament. Status: In force. wheresthe.ai, https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/ (verified 4 Oct 2026).

Line of Thought

Developments connected to this rule

What has happened that this rule shapes, or that shapes it. Pick one to keep following the thread.

More from United Kingdom