UK GDPR AI and Automated Decisions

Identify the decision made about a person, such as refusing credit, rejecting an application, changing access to an essential service, or imposing another outcome with a legal or comparably serious effect. A low-impact recommendation or internal score may fall outside Article 22A if it does not determine or materially shape such an outcome, but the rest of UK GDPR still applies.

Human involvement must affect the decision in practice. A person who automatically accepts a score, lacks authority to change the outcome, or sees too little information to assess it may not provide meaningful involvement. Article 22A requires consideration of the extent to which profiling produced the decision.

Article 22B restricts a significant solely automated decision based entirely or partly on special-category processing. It is allowed only where the person explicitly consented to all personal-data processing on which the decision is based, or where the decision is necessary for a contract or required or authorised by law and Article 9(2)(g) substantial public interest applies.

A significant solely automated decision also cannot rely entirely or partly on Article 6(1)(ea), the recognised legitimate interests basis. Other significant solely automated decisions are no longer limited to the former contract, law, or explicit-consent routes, but they still need an Article 6 basis and must satisfy fairness, transparency, minimisation, accuracy, security, and other applicable UK GDPR duties.

For every significant solely automated decision based on personal data, Article 22C requires measures that provide the person with information about the decision and enable them to make representations, obtain human intervention from the controller, and contest the decision. Build these routes into the service rather than relying on a general contact address that cannot pause or change the outcome.

Keep a decision inventory, significance and human-involvement analysis, lawful-basis record, DPIA, data and model documentation, accuracy and bias tests, monitoring results, notices, representation and contest workflows, reviewer instructions, response records, and change history.