http://www.legislation.gov.uk/ukpga/2018/12/section/49/enactedData Protection Act 2018enKing's Printer of Acts of Parliament2024-03-26
Data Protection Act 2018s. 26(2)(f)(ai)The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026Sch. 2 para. 23(2)(3)reg. 1(4)reg. 1(2)Data Protection Act 2018Sch. 3 para. 8(1)(y)Adoption and Children Act (Northern Ireland) 2022Sch. 3 para. 78(3)s. 160(1)
PART 3Law enforcement processingCHAPTER 3Rights of the data subjectAutomated individual decision-makingRight not to be subject to automated decision-making
49
1
A controller may not take a significant decision based solely on automated processing unless that decision is required or authorised by law.
2
A decision is a “significant decision” for the purpose of this section if, in relation to a data subject, it—
a
produces an adverse legal effect concerning the data subject, or
b
significantly affects the data subject.