Data (Use and Access) Act 2025 automated decision-making

Required actions

Solely automated decisions with significant effects are permitted for most personal data provided safeguards apply: inform the person, allow representations, provide human intervention and a right to contest - Decisions based on special-category data remain restricted to consent, contract or substantial public interest grounds - Keep records demonstrating the safeguards and respond to complaints; the Information Commission may issue guidance and codes

Sources

legislation.gov.ukhttps://www.legislation.gov.uk/ukpga/2025/18

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Add regulation Report a correction or request removal

Related in Regulation Tracker

UK Cyber Security and Resilience (Network and Information Systems) Bill

The UK's NIS2-equivalent reform, still before the House of Lords in September 2026 with Royal Assent expected late in the year, extends cyber duties to data centres and managed service providers hosting AI workloads.

United KingdomIn legislative process

Getty Images v Stability AI [2025] EWHC — UK judgment on AI training and outputs

The first major AI copyright judgment in the UK: Stability AI's image model was held not to be an infringing copy of Getty's photographs, leaving the legality of training itself to Parliament's pending reform.

United KingdomIn force

United Kingdom AI Regulation Framework

The UK regulates AI through existing regulators and principles rather than an AI act, but has built the most active government evaluation body and the first national code of practice for AI cybersecurity.