Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Sign inBecome a Member
Home/Regulation Tracker/UK GDPR and Data Protection Act 2018 — automated decision-making and profiling provisions

UK GDPR and Data Protection Act 2018 — automated decision-making and profiling provisions

The UK data protection regime as it applies to AI: DPIAs for profiling and novel technology, transparency about automated logic, and the Article 22 automated-decision rules now reshaped by the 2025 Data (Use and Access) Act. Enforced by the ICO with fines up to 4% of turnover.

ukdata protectionautomated decision-makingico

Required actions

  • Comply with Article 22 restrictions on solely automated decisions with legal or similarly significant effects, as reformed by the Data (Use and Access) Act - Complete a DPIA for systematic profiling and innovative technology, and consult the ICO where residual risk is high - Provide meaningful information about the logic of automated decisions and honour objection rights

Sources

PreviousMAS FEAT Principles for AI and data analytics in financeNextMiFID II algorithmic trading rules (Article 17 and RTS 6)

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Add regulationReport a correction or request removal

Related in Regulation Tracker

UK Cyber Security and Resilience (Network and Information Systems) Bill

The UK's NIS2-equivalent reform, still before the House of Lords in September 2026 with Royal Assent expected late in the year, extends cyber duties to data centres and managed service providers hosting AI workloads.

United KingdomIn legislative process

Getty Images v Stability AI [2025] EWHC — UK judgment on AI training and outputs

The first major AI copyright judgment in the UK: Stability AI's image model was held not to be an infringing copy of Getty's photographs, leaving the legality of training itself to Parliament's pending reform.

United KingdomIn force

United Kingdom AI Regulation Framework

The UK regulates AI through existing regulators and principles rather than an AI act, but has built the most active government evaluation body and the first national code of practice for AI cybersecurity.

United KingdomIn force