UK Data (Use and Access) Act and Automated Decisions

DUAA 2025 section 80 amended the UK GDPR, replacing Article 22 with Articles 22A–22D for certain solely automated individual decisions. Government commencement guidance says the principal Part 5 data-protection changes commenced on 5 February 2026. These provisions are in force, not merely a bill proposal. Article 22A defines a decision as solely automated when there is no meaningful human involvement, and significant when it has a legal or similarly significant effect for the person. A human sign-off may not be meaningful if the reviewer cannot influence the result. Controllers must consider profiling when judging whether involvement is meaningful. For significant solely automated decisions, Article 22C requires safeguards: information about the decision, an opportunity to make representations, human intervention, and a way to contest. Article 22B restricts significant decisions using special-category data: explicit data-subject consent is one route. Alternatively, the decision must be contract-necessary or required/authorised by law, and Article 9(2)(g) must permit processing for substantial public interest under DPA 2018 Schedule 1. Authorization alone is insufficient; Article 22B(4) bars Article 6(1)(ea). The regime applies within UK data protection law and depends on the controller, data, decision significance, and meaningful human involvement. Law enforcement has a separate Part 3 regime. For a specific process, map the workflow, human influence, lawful basis, and safeguards; provide clear challenge routes and check current legislation and ICO guidance. This is a general summary, not case-specific legal advice.