Automated decisions about workers under UK data law

When software decides who gets an interview, a shift, a bonus or a warning, data protection law sets the rules for how that decision may be made. In the UK those rules changed on 5 February 2026, when the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with four new articles, 22A to 22D. This page sets out what they say, taken from the text on legislation.gov.uk, and what they mean for employers and workers. For the EU rules, which did not change in the same way, see GDPR duties for employers using AI on worker data.

The short answer: UK employers may now take significant decisions about people based solely on automated processing in more situations than before, but only with safeguards: they must tell the person about the decision and let them make representations, get human intervention and contest it. Tighter limits remain where the decision uses special category data, such as health data, or relies on the new recognised legitimate interests basis.

What changed and when

Section 80 of the Data (Use and Access) Act 2025 substituted a new Section 4A, Articles 22A to 22D, for the old Article 22 (Data (Use and Access) Act 2025, section 80). It came into force for specified purposes on 19 June 2025 and otherwise on 5 February 2026 (UK GDPR Article 22A, with annotations). The commencement regulations say the changes do not apply to decisions taken before 5 February 2026 to which the old Article 22(3) safeguards applied (S.I. 2026/82, regulation 5).

The old Article 22 started from a right not to be subject to such decisions, with exceptions. The new articles start from a set of restrictions and required safeguards instead.

Key definitions: Article 22A

• Solely automated: a decision is based solely on automated processing if there is no meaningful human involvement in taking it.
• Significant: a decision is significant if it produces a legal effect for the person or has a similarly significant effect.
• Profiling counts against you: when judging whether human involvement is meaningful, the extent to which the decision is reached by means of profiling must be considered.

At work, rejecting an applicant, refusing a promotion, cutting hours or starting dismissal are the kind of decisions that are likely to be significant. A manager who clicks to approve whatever a system recommends is unlikely to be meaningful human involvement.

Where it is still restricted: Article 22B

• Special category data: a significant decision based entirely or partly on special category data, such as health, ethnicity or trade union membership, may not be solely automated unless the person gave explicit consent, or the decision is necessary for a contract or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies.
• Recognised legitimate interests: a significant decision may not be solely automated if the processing for it relies on the new recognised legitimate interest basis in Article 6(1)(ea) (UK GDPR Article 6).

Safeguards that must be in place: Article 22C

Where a significant decision is based on personal data and taken solely by automated processing, the controller must ensure safeguards that include measures which:

• provide the person with information about the decision;
• enable them to make representations about it;
• enable them to obtain human intervention from the controller;
• enable them to contest the decision.

The privacy notice and the right of access still require information about the existence of such automated decision-making and meaningful information about the logic involved, its significance and envisaged consequences, now linked to the Article 22C safeguards (UK GDPR Article 13(2)(f)). For how workers can ask for this, see how to request the data AI systems hold on you.

Under Article 22D the Secretary of State may make regulations on what counts as meaningful human involvement or a similarly significant effect, and adding to the safeguards. Check whether any such regulations have been made before relying on your own reading.

Practical steps for employers

• List the decisions about candidates and staff where a system decides without a person really weighing the outcome.
• For each, check whether health or other special category data feeds in, and which legal basis you rely on. If either limit in Article 22B applies, put a person with real authority back into the decision.
• Build the four Article 22C safeguards into the process: a notice of the decision, a way to respond, a named route to a human reviewer and a way to challenge.
• Make sure reviewers can actually change the result, and record when they do. See AI in hiring and AI in performance reviews.

For workers and candidates

If a decision about you seems to have come from a system, ask whether any person reviewed it and what information it used. You can make representations, ask for a human to look at it and contest it. Keep copies of what you were told. For the rules on monitoring itself, see monitoring workers in the UK. This page is general information, not legal advice.