What UK law already says about automated decisions
Companion to the last piece: the legal detail behind why a human always needs to be able to change the outcome, and what actually changed for employers this February.
A law most employees have never heard of
Article 22 of UK GDPR has, for years, given people a right not to be subject to a decision based solely on automated processing where it has a legal or similarly significant effect on them. Almost nobody knows this exists until they need it. Since 5 February 2026, this right has been rewritten rather than removed, and the difference is worth understanding precisely.
What changed in February
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and section 80 of that Act replaced the old Article 22 with three new provisions, Articles 22A to 22C, which commenced on 5 February 2026. The old blanket restriction on solely automated significant decisions now applies fully only where special category data, health information, for example, is involved. For ordinary significant decisions, including recruitment shortlisting or rejection, an employer can now rely on legitimate interests as its lawful basis, where previously it needed a contract, a specific law, or explicit consent. That is a genuine loosening, and it is worth being honest about it rather than glossing over it.
What stayed exactly the same
The safeguards did not loosen alongside the lawful basis. Article 22C still requires that a person be told a significant decision was made in a solely automated way, be able to make representations about it, be able to obtain meaningful human intervention, and be able to contest the decision. Article 22A defines what counts as a significant decision, a legal effect or a similarly significant one, and what counts as meaningful human involvement, which is the part that stops a rubber stamp from counting.
The safeguard was never that a human sees the decision. It is that a human can change it.
What this looks like for an actual employee
Take someone rejected at the shortlisting stage by an automated screening tool. Under the new rules, the employer may have an easier lawful basis for having run that process solely by automation. But the candidate is still entitled to know a solely automated decision was involved, and to ask for a real person to look at it again. That right did not move.
It is worth being precise about what "significant" means here too, since it is doing a lot of work in the statute. Article 22A ties it to a legal effect or an effect similarly significant to the person concerned. A rejection at the shortlisting stage of a job clearly qualifies. A minor variation in which day a shift-swap request gets processed, on its own, is unlikely to. The test is the weight of the consequence, not simply whether a computer was involved.
The bit still being written
The ICO's general guidance on automated decision-making is being revised to match this reform. It ran a consultation on the draft guidance from 31 March to 29 May 2026, and as of this piece, the updated version has not yet been published. Treat the existing guidance as the current word on the subject, but expect more detail once the ICO's revision lands, and do not assume the final version will read identically to the draft.
What a sensible employer does now
Do not wait for the finalised guidance to put the basics in place. Know where your business already uses a solely automated process to make a significant decision about someone, make sure a real, named person could actually review and overturn it, and be ready to tell someone plainly if a decision about them was automated. That is what the law already asks for, whichever lawful basis you are relying on.
It is also worth checking your paperwork keeps pace with your practice. If a privacy notice or a candidate-facing policy still describes a process as having a human review every application, and the actual process has quietly become fully automated at the first stage, that gap between what is written and what happens is itself something Article 22C's disclosure duty is aimed at closing.
Why the record matters here too
None of these safeguards mean anything if you cannot show, afterwards, that they happened. Jamie HR keeps a clear record of decisions and who reviewed them, which is exactly the evidence Article 22C's safeguards actually depend on.