Data Protection Act 2018

Automated individual decision-making U.K.

F1 49 Right not to be subject to automated decision-making U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F1 Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(3), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)

F1 50 Automated decision-making authorised by law: safeguards U.K.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Textual Amendments

F1 Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(3), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)

[F1 50A Automated processing and significant decisions U.K.

(1) For the purposes of sections 50B and 50C—

(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and

(b) a decision is a significant decision, in relation to a data subject, if—

(i) it produces an adverse legal effect for the data subject, or

(ii) it has a similarly significant adverse effect for the data subject.

(2) When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

Textual Amendments

F1 Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(3), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)

50B Restrictions on automated decision-making based on sensitive processing U.K.

(1) A significant decision based entirely or partly on sensitive processing may not be taken based solely on automated processing, unless one of the following conditions is met.

(2) The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.

(3) The second condition is that the decision is required or authorised by law.

Textual Amendments

F1 Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(3), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)

50C Safeguards for automated decision-making U.K.

(1) Subject to subsection (3), where a significant decision taken by or on behalf of a controller in relation to a data subject is—

(a) based entirely or partly on personal data, and

(b) based solely on automated processing,

the controller must ensure that safeguards for the data subject’s rights, freedoms and legitimate interests are in place which comply with subsection (2) and any regulations under section 50D(4).

(2) The safeguards must consist of or include measures which—

(a) provide the data subject with information about decisions described in subsection (1) taken in relation to the data subject;

(b) enable the data subject to make representations about such decisions;

(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;

(d) enable the data subject to contest such decisions.

(3) Subsections (1) and (2) do not apply in relation to a significant decision if—

(a) exemption from those provisions is required for a reason listed in subsection (4),

(b) the controller reconsiders the decision as soon as reasonably practicable, and

(c) there is meaningful human involvement in the reconsideration of the decision.

(4) Those reasons are—

(a) to avoid obstructing an official or legal inquiry, investigation or procedure;

(b) to avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;

(c) to protect public security;

(d) to safeguard national security;

(e) to protect the rights and freedoms of others.

(5) When considering whether there is meaningful human involvement in the reconsideration of a decision, a person must consider, among other things, the extent to which the conclusion reached on reconsideration is reached by means of profiling.

Textual Amendments

F1 Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(3), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)

50D Further provision about automated decision-making U.K.

(1) The Secretary of State may by regulations provide that, for the purposes of sections 50A(1)(a) and 50C(3)(c), there is, or is not, to be taken to be meaningful human involvement in the taking or reconsideration of a decision in cases described in the regulations.

(2) The Secretary of State may by regulations provide that, for the purposes of section 50A(1)(b)(ii), a description of decision is, or is not, to be taken to have a similarly significant adverse effect for the data subject.

(3) Regulations under subsection (1) or (2) may amend section 50A.

(4) The Secretary of State may by regulations make the following types of provision about the safeguards required under section 50C(1)—

(a) provision requiring the safeguards to include measures in addition to those described in section 50C(2),

(b) provision imposing requirements which supplement what section 50C(2) requires the safeguards to consist of or include (including, for example, provision about how and when things described in section 50C(2) must be done or be capable of being done), and

(c) provision about measures which are not to be taken to satisfy one or more of paragraphs (a) to (d) of section 50C(2).

(5) Regulations under this section are subject to the affirmative resolution procedure.]

Textual Amendments

F1 Ss. 50A-50D substituted for ss. 49, 50 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(3), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)