Data (Use and Access) Act 2025: new rules on automated decision-making
BuildAIPolicy Research · Added 27 October 2026 · Last checked 27 October 2026
What it is
The UK GDPR's rules on automated decisions changed. The general prohibition now applies only to significant decisions based entirely or partly on special category data. For other significant automated decisions using personal data, safeguards apply, such as telling people and letting them contest the decision. Organisations must also be able to handle data protection complaints directly, from 19 June 2026.
Who it affects
Organisations that use personal data of people in the UK to make significant automated decisions.
What to consider
- Identify significant decisions made solely by automated means, including AI.
- Check that people are told about them and can contest them and get human review.
- Watch for the ICO's updated guidance on automated decision-making.
Sources
Put rules like this into practice
The AI Policy & Risk Pack gives your organisation an AI use policy, a risk register, an AI tool inventory and notice wording, written from how you use AI. Preview every section free before you pay. It isn't legal advice.
A general summary of public information, checked against the sources listed on the date shown. It isn't legal advice and may not cover every rule that applies to you. Check the sources, and get professional advice for your situation.