Summary
- Old Art. 22 is gone. DUAA s.80 replaced it with Arts. 22A to 22D (commenced 2026-02-05 per SI 2026/82, from secondary sources; the ICO guidance uses the new article numbers).
- ADM is now allowed on any lawful basis, including legitimate interests, as long as safeguards are in place (ICO DUAA overview). Special category data stays restricted, for example to explicit consent or specified legal grounds (Art. 22B per ICO).
- Mandatory safeguards (Art. 22C): tell people about significant decisions taken about them, let them make representations, let them obtain human intervention, and let them contest the decision.
- Scope test (Art. 22A): a "significant decision" based "solely" on automated processing. Meaningful human involvement takes a decision out of scope. ICO draft guidance suggests applying safeguards to all decisions where you cannot reliably separate those with significant effects.
- Other AI-relevant parts unchanged in substance: transparency duties (Arts. 13 to 15), DPIAs (Art. 35), lawful basis for training (Art. 6), and extraterritorial reach (Art. 3(2)).
Who it applies to
- Controllers and processors established in the UK, plus non-UK organisations offering goods or services to, or monitoring, people in the UK (Art. 3(2)). Non-UK controllers usually need a UK representative (Art. 27).
- All sectors. Law enforcement and intelligence processing have separate parts of the DPA 2018.
Key dates
- Data Protection Act 2018 and EU GDPR apply in the UK
- Retained EU GDPR becomes the 'UK GDPR' after Brexit transition (secondary; not re-checked on legislation.gov.uk)
- Data (Use and Access) Act 2025 receives Royal Assent; ICO publishes DUAA guidance
- DUAA s.80 commences: Art. 22 replaced by Arts. 22A to 22D (SI 2026/82; secondary sources)
- ICO publishes draft updated ADM guidance for consultation
- ICO confirms all DUAA data protection provisions are in force
Full date record
| Date | Event |
|---|---|
| 2018-05-25 | DPA 2018 and GDPR apply |
| 2021-01-01 | UK GDPR (retained EU law) takes effect after Brexit (secondary) |
| 2025-06-19 | DUAA Royal Assent |
| 2026-02-05 | New ADM rules (Arts. 22A to 22D) commence; decisions taken before this date keep the old safeguards (SI 2026/82 reg. 5, secondary) |
| 2026-03-31 to 2026-05-29 | ICO consultation on updated ADM guidance (end date secondary) |
| 2026-06-19 | All DUAA data protection provisions in force, including the new complaints duty (ICO) |
Penalties and enforcement
- ICO can fine up to GBP 17.5 million or 4% of global turnover for the most serious breaches.
- DUAA also gave the ICO new powers; ICO says it will publish guidance before using them but may act in the most serious cases now.
- From 2026-06-19 controllers must handle data protection complaints themselves first (new complaints regime, per ICO and secondary sources).
- ICO's final ADM guidance was still in draft at the last check; status after August 2026 not confirmed.
What it means for an Indian company
- Indian SaaS, fintech and HR tech firms with UK users are directly covered by Art. 3(2).
- Good news: you no longer need consent or contract necessity to run significant automated decisions on ordinary personal data. Bad news: the Art. 22C safeguards are mandatory and must be decision-specific, not a line in a privacy notice.
- Build: decision notices that say an automated decision was made, a channel for representations, a human review route, and a contest process (SC-AI-027 Right to contest and human review for individuals, SC-AI-024 Explain AI-assisted decisions, SC-AI-028 Customer grievance redressal for AI).
- Keep the lawful basis analysis per purpose (SC-AI-011 Lawful basis and consent for personal data used in AI) and a DPIA for AI uses (SC-AI-006 AI impact assessment (people and society)).
- If you serve both the EU and UK, design to the stricter EU Art. 22 and add the UK safeguards; one process can satisfy both. See EU GDPR.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when UK GDPR and DPA 2018 (as amended by DUAA 2025) is done.
Glossary
- DUAA: Data (Use and Access) Act 2025, the UK reform law.
- ADM: automated decision-making; in ICO guidance, decisions in scope of Art. 22A.
- Significant decision: one with legal or similarly significant effects on a person.
- Recognised legitimate interest: a new pre-approved lawful basis for listed public-interest purposes with no balancing test; ICO lists it as a second restriction on ADM (see Art. 22B).
- Special category data: health, biometrics, ethnicity, religion, sexual orientation and similar sensitive data.
- ICO: Information Commissioner's Office, the UK regulator.
Key takeaways
- Not AI-specific, but the UK now has bespoke ADM rules (Arts. 22A to 22D) in force since 2026-02-05.
- ADM is permitted on any lawful basis with mandatory safeguards; special category data stays restricted.
- Extraterritorial: covers Indian firms serving or monitoring UK users.
- legislation.gov.uk was blocked, so commencement dates rely on ICO plus law firm sources; reviewer should confirm.
Official sources
- ICO: Automated decision-making (draft guidance, updated 31 March 2026), accessed 2026-10-19
- ICO: The Data (Use and Access) Act 2025, what does it mean for organisations (updated 19 June 2026), accessed 2026-10-19
- SI 2026/82, DUAA Commencement No. 6 Regulations (legislation.gov.uk), not reachable on 2026-10-19 (blocked); dates taken from secondary sources
- Data (Use and Access) Act 2025 (legislation.gov.uk), not reachable on 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.