What are the rules on automated decision-making and profiling?

What it is

The DUAA replaced the old Art 22 prohibition with Arts 22A to 22D. A decision is based solely on automated processing where there is no meaningful human involvement, and is significant where it has a legal or similarly significant effect, such as refusing credit or a job. Profiling is automated evaluation of personal aspects, such as predicting performance or behaviour.

What the rules require

• Safeguards for every significant solely automated decision: information, representations, human intervention and the ability to contest. UK GDPR Arts 22A and 22C
• Using special category data only with explicit consent, or where necessary for a contract or required by law and for a substantial public interest. Art 22B
• A DPIA for systematic and extensive evaluation that leads to significant decisions. Art 35(3)(a)

When the rules do not apply

• Decisions with meaningful human involvement, where a person weighs the output and can change the outcome. Art 22A(1)
• Decisions without legal or similarly significant effects.

Who is responsible

The controller making the decision. Decisions taken before 2026-02-05 under the old safeguards are not caught by the new provisions.

What it involves

1. Identify decisions that are solely automated and significant.
2. Build in the Art 22C safeguards.
3. Check the special category limits.
4. Complete a DPIA.
5. Explain the logic and consequences in your privacy information.

If it goes wrong

Regulatory

Breach of Arts 22A to 22D. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change.

Criminal

No offence.

Civil

The person can apply to court for a compliance order (DPA 2018 s.167) and claim compensation for damage or distress (Art 82; s.168).