Home › Guides · Updated 21 October 2026

AI decisions about you: your UK data rights after the Data (Use and Access) Act

How the Data (Use and Access) Act 2025 changed the rules on automated decision-making in the UK, the safeguards you're still entitled to, and how to challenge an AI or algorithmic decision about you.

Algorithms already help decide who gets a loan, which job applications reach a human and how insurance is priced. As AI tools spread, more of these decisions may be made with little or no human involvement. UK data protection law has long given people specific protections against decisions made solely by automated means, and those rules were rewritten by the Data (Use and Access) Act 2025 (DUAA). This guide explains what changed and what rights you still have.

This is general information, not legal advice.

What counts as an automated decision?

The rules focus on significant decisions based solely on automated processing: decisions with legal or similarly significant effects on you, made without meaningful human involvement. Examples could include an online credit application that is automatically refused, or a recruitment system that rejects candidates before any person looks at them. A system that simply helps a human make the decision, where the human genuinely weighs it up, is treated differently.

The legal detail is in section 80 of the Data (Use and Access) Act 2025, which replaced the previous Article 22 of the UK GDPR with a new set of provisions.

What the DUAA changed

Under the old rules, solely automated significant decisions were generally prohibited unless one of a small number of conditions applied, such as your explicit consent or necessity for a contract. The DUAA turns this around for most personal data. The Information Commissioner's Office (ICO) explains that the Act opens up the full range of lawful bases organisations can rely on for significant automated decisions, potentially including legitimate interests, as long as they apply appropriate safeguards.

It is explicit that this doesn't apply to special category data, which remains more protected. Special category data includes information about health, ethnicity, religion, sexual orientation, trade union membership, and biometric and genetic data. Significant automated decisions using it remain tightly restricted.

The ICO's guidance, updated in June 2026, confirms that all data protection provisions of the DUAA are now in force; the changes were phased in between June 2025 and June 2026. The ICO's statement on commencement gives more background on the timing.

The safeguards you're still entitled to

In exchange for wider permission, organisations must provide a set of safeguards. Under the provisions inserted by section 80, where a significant decision about you is based solely on automated processing, the organisation must have measures that:

1. give you information about decisions of this kind made about you;
2. let you make representations about the decision;
3. let you obtain human intervention from the organisation;
4. let you contest the decision.

In other words, an organisation can now more easily use automation, but it cannot leave you facing a computer that says no with nowhere to go.

What "meaningful human involvement" means

Whether these rules apply at all depends on whether a decision is "based solely on automated processing". The new Article 22A says that is the case if there is no meaningful human involvement in the taking of the decision. When judging that, an organisation must consider, among other things, the extent to which the decision is reached by means of profiling.

In practice, a person who simply clicks "approve" on whatever the system recommends, without the authority or information to do anything else, is unlikely to count as meaningful involvement. A reviewer who looks at the evidence, can overrule the system and sometimes does is more likely to. The Act also lets the government make regulations clarifying what does and doesn't count as meaningful human involvement, and what counts as a "similarly significant" effect.

Limits that still apply

Two restrictions in the new Article 22B are worth knowing:

• Special category data. A significant decision based entirely or partly on special category data may not be taken solely by automated means unless you have given explicit consent, or the decision is necessary for a contract with you or required or authorised by law and a substantial public interest condition applies.
• Recognised legitimate interests. An organisation can't take a solely automated significant decision where the processing relies on the new "recognised legitimate interests" lawful basis.

Your other data rights still apply

The DUAA amends, but doesn't replace, the UK GDPR, the Data Protection Act 2018 and the privacy and electronic communications rules, as the ICO's overview sets out. That means your existing rights remain, including:

• The right to be informed: privacy notices should explain if and how automated decision-making is used.
• The right of access: you can ask what personal data an organisation holds and how it uses it. The DUAA clarifies that organisations need only make reasonable and proportionate searches.
• The rights to rectification and objection, which matter if a decision was based on wrong data or on processing you object to.

New: a duty to handle your complaints

The DUAA added a new requirement. Organisations must take steps to help people make data protection complaints, such as providing an electronic complaints form, must acknowledge complaints within 30 days, and must respond without undue delay. This gives you a clearer first route if you think an automated decision was unfair.

How to challenge an automated decision: step by step

1. Ask whether the decision was automated. Check the privacy notice, then ask the organisation directly whether a person was meaningfully involved.
2. Ask for information about the decision, which the organisation must provide for solely automated significant decisions.
3. Request human intervention and set out why you think the decision is wrong, including any errors in the data used. Keep a copy and note the date.
4. Contest the decision formally if the review doesn't resolve it, using the organisation's complaints process.
5. Escalate. If you're still unhappy, you can complain to the ICO. For financial products, the Financial Ombudsman Service may also be able to look at the outcome itself.

What's still to come

The ICO has consulted on draft guidance on automated decision-making and profiling, and its plans for technology guidance list further work in this area. Expect more detail on what "meaningful human involvement" and adequate safeguards look like in practice. Until then, the statutory safeguards above are the baseline.

Using AI tools yourself

These rules are about decisions organisations make about you. They're separate from what happens to the information you type into AI chatbots. For that, see our guide to AI tools and your privacy settings, and our checklist for checking whether AI-generated information is accurate.

Sources and further reading

• legislation.gov.uk: Data (Use and Access) Act 2025, section 80
• ICO: The Data Use and Access Act 2025: what does it mean for organisations?
• ICO: Statement on the commencement of the DUAA
• ICO: Our plans for new and updated guidance: technology
• ICO: Make a complaint

Facts and links checked on 21 October 2026. Spotted an error? Tell us and we will correct it.