Library
The Data (Use and Access) Act 2025 and the New UK ADM Regime
Section 80 of the Data (Use and Access) Act 2025 replaced UK GDPR Article 22 with Articles 22A–22D from 5 February 2026. The old default was prohibition-plus-exceptions. The new default for most significant automated decisions is permission-plus-safeguards. Special-category decisions stay tighter.
Last reviewed
MikeFounder & developer
- UK AI
- EU data & privacy
- Compliance
On this page
Who this is for
- UK controllers whose systems take decisions about people with little or no human look
- Teams still quoting “Article 22 UK GDPR” as if it were the current text
- Readers of AI Flags It, You Confirm who need the UK article numbers
Commencement: do not assume the whole Act is live
The Data (Use and Access) Act 2025 (c. 18) commenced in stages.
Section 80 (automated decision-making) and Schedule 6 came into force on 5 February 2026 by the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), regulation 2(j).
SI 2026/82, regulation 5: the new Articles do not apply to decisions taken before 5 February 2026 that were already in the old Article 22(3) / DPA 2018 automated-decision rules. New decisions from that date are in the new regime.
Other DUAA provisions (cookies, complaints acknowledgement, transfer-test wording, and more) have different commencement dates. This page is only the ADM rewrite. Check the latest commencement SI before relying on a different section.
Old Article 22 versus new 22A–22D
| Old UK GDPR Art. 22 | New Arts 22A–22D (from 5 Feb 2026) | |
|---|---|---|
| Default | Prohibition on solely automated significant decisions, unless an exception (contract, authorised by law, explicit consent) | For ordinary personal data: permitted, if Article 22C safeguards are in place |
| Special-category data | Tight (Art. 22(4)) | Still tight: Article 22B: significant decisions based entirely or partly on Art. 9(1) data may not be solely automated unless explicit consent, or contract/authorised-by-law and Art. 9(2)(g) |
| “Solely automated” | Not defined in the article | Article 22A(1)(a): a decision is based solely on automated processing if there is no meaningful human involvement |
| Significant decision | Legal or similarly significant effects | Article 22A(1)(b): produces a legal effect, or a similarly significant effect |
| Profiling | In the old chapeau | Article 22A(2): when judging meaningful involvement, you must consider, among other things, the extent to which the decision is reached by profiling |
| Safeguards | Human intervention, express a view, contest, in the exception cases | Article 22C(2): information about the decision; ability to make representations; human intervention; ability to contest. Regulations under 22D may add more |
For most controllers the live question is whether you can evidence the 22C safeguards, and whether involvement is genuine if you claim you are outside solely-automated.
Meaningful human involvement
The statute does not define the phrase beyond 22A(1)(a) and the profiling prompt in 22A(2). The ICO's draft ADM guidance (consultation 31 March–29 May 2026; final version due winter 2026 per the ICO's technology guidance plan) is the working enforcement read. Until that guidance is final, treat “meaningful” as: a named person who sees the material, can change the outcome, and has time to do it.
A confirm-click with no file fails. The design patterns are on Human Oversight by Design. The EU comparator (still Article 22 GDPR) is the EU page.
What 22C requires you to be able to do
When a significant decision is solely automated:
- Tell the person about those decisions.
- Let them make representations.
- Let them obtain human intervention from the controller.
- Let them contest the decision.
Do it in the product, not only in a privacy notice. The ICO will ask how a person actually gets a human, not whether paragraph 14 of the notice mentions one.
Questions
Is section 80 in force?
Yes. 5 February 2026, SI 2026/82, regulation 2(j). Decisions taken on or after that date.
Can we now automate significant decisions as a default?
For non-special-category data, the statute no longer starts with a ban. You still need 22C safeguards, a lawful basis, and, if you claim a human is in the loop, meaningful involvement under 22A. Special-category significant decisions remain restricted under 22B.
Does this replace the EU AI Act for UK firms?
No. If you place systems on the Union market or the output is used there, the EU timeline still applies. This page is the UK GDPR ADM rewrite only.
Where is the ICO code?
SI 2026/425 requires the Commissioner to prepare a statutory code on AI and ADM. The code is not published. Track it on the status board.
What changed
- 13 August 2026: First publication. Cadence: high-risk / fast-moving (30–90 days). Next review due 13 October 2026. Off-cycle when the ICO finalises ADM guidance or lays the statutory code.
Note: This is compliance consulting and training, not legal advice. We work alongside your legal counsel, translating regulation into operational reality rather than replacing them. For a structured pass, see AI compliance.
Was this helpful?
Also in the library
- GDPR and AI: Where the Two Actually OverlapThe GDPR is stable. What keeps moving is how the EDPB applies it to models. The overlap that matters in practice is three points: a legal basis for training and inference, purpose limitation when you reuse customer data for a new AI feature, and when an AI system triggers a DPIA.
- Automated Decision-Making Under GDPR Article 22In the EU, Article 22 GDPR still restricts solely automated decisions with legal or similarly significant effects, with a right to human intervention. ‘Meaningful’ involvement is a person who can change the outcome. A click is not enough. The UK has replaced Article 22 with Articles 22A–22D; that regime is a separate page.
- The Global AI & Data Regulation CalendarNext hard date after 13 August 2026: 2 December 2026. EU Article 50(2) marking grace ends, and two new Article 5 prohibitions apply. The table below is every live and upcoming deadline we currently track from the EU, UK, US and China pages. It will move. That is why the page exists.