Data Governance Atlas UK edition

Automated decision-making rights

How to run, and respond to challenges about, significant decisions based solely on automated processing under UK GDPR Arts 22A to 22D, in force from 2026-02-05.

Applies to
Controllers taking decisions with legal or similarly significant effects without meaningful human involvement. Law enforcement processing follows DPA 2018 Part 3.
Instruments
UK GDPR, DPA 2018
Steps
7 steps, with a deadline calculator.

Deadline calculator

Other data subject rights request

Rectification, erasure, restriction, portability, objection and automated decision requests: one calendar month from receipt, extendable by two further months for complex or numerous requests. Same counting as subject access.

Enter a date to calculate.

Basis: UK GDPR Art 12(3) and Art 12A. Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.

Mechanics

Item Position
Deadline One calendar month from receipt
Extension Two further months for complex or numerous requests, notified within the first month
Stop the clock While reasonably waiting for identity or clarification (Art 12A)
Cost Free; a reasonable fee or refusal only if manifestly unfounded or excessive
In force Arts 22A to 22D from 2026-02-05 (SI 2026/82)
Safeguards Information, representations, human intervention, contest

Steps

  1. Decide whether the decision is in scope

    A decision is based solely on automated processing if there is no meaningful human involvement in taking it, taking account of how far it is reached through profiling. It is significant if it has a legal or similarly significant effect on the person (Art 22A).

    See UK GDPR

  2. Check the special category limits

    Significant automated decisions based on special category data face tighter limits (Art 22B). Check the condition before deploying.

    See UK GDPR

  3. Put the safeguards in place

    Tell people about significant decisions taken about them; let them make representations; let them obtain human intervention; and let them contest the decision (Art 22C).

    See UK GDPR

  4. Do the DPIA

    Automated decision-making with significant effects is high-risk processing: complete a DPIA before deployment.

    See UK GDPR

  5. Handle a request for human intervention or contest

    Log it, route it to a person with the authority and information to change the outcome, and review the decision on its merits, not just the process.

    See UK GDPR

  6. Respond within one month

    Give the outcome of the review and the reasons. Explain the logic involved where asked, as part of the access and transparency duties.

    See UK GDPR

  7. Handle any complaint

    A dissatisfied requester complains to you first under your s.164A process (complaints received from 2026-06-19), then to the Information Commission.

    See DPA 2018

Checklists and tools for this procedure

DPIA screening

Checklist for data protection

Screen a project for the cases where a data protection impact assessment is mandatory, before the processing starts.

Automated decision safeguards (Arts 22A to 22D)

Checklist for data protection

Check a solely automated significant decision against the UK safeguards model that replaced Art 22 from 2026-02-05.

Explainers

Sources