# Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making

- **Jurisdiction:** United Kingdom (GB)
- **Type:** Law · **Status:** In force · **Binding:** yes
- **Issued by:** UK Parliament
- **Proposed:** 23 Oct 2024 · **Adopted:** 19 Jun 2025 · **Effective:** 5 Feb 2026
- **Obligations:** Human oversight, Transparency to users, Data governance
- **Sectors:** All sectors
- **Penalties:** UK GDPR maximum: GBP 17.5 million or 4% of worldwide turnover.

## Summary
Replaces UK GDPR Article 22 with new Articles 22A-22D: solely automated decisions with legal or similarly significant effects are broadly permitted on any lawful basis if safeguards apply (information, ability to contest, human intervention), while stricter limits remain for special-category data. Applies to all controllers using automated decision-making, including AI.

## Why it matters
Since 5 Feb 2026 UK organisations can rely on legitimate interests for significant automated decisions, but must provide notice, human review and a route to challenge.

## Source
[legislation.gov.uk (SI 2026/82)](https://www.legislation.gov.uk/uksi/2026/82/made) · [secondary](https://www.legislation.gov.uk/ukpga/2025/18/contents)
Checked against the source on 4 Oct 2026. Section 80 commenced 5 Feb 2026 by the Commencement No. 6 Regulations (SI 2026/82), with saving provisions for decisions taken before that date.

## Cite
Data (Use and Access) Act 2025, section 80 and Schedule 6 - Automated decision-making. UK Parliament. Status: In force. wheresthe.ai, https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/ (verified 4 Oct 2026).

---
Canonical page: https://wheresthe.ai/rule/gb-data-use-and-access-act-2025-automated-decisions/ · Not legal advice.