Automated Decision-Making: Essential DUAA Rules to Avoid Risk
Section 80 of the Data (Use and Access) Act 2025 deleted Article 22 of the UK GDPR and replaced it with Articles 22A to 22D, commenced on 5 February 2026. The prohibition became a permission with conditions: for ordinary personal data you may now make solely automated significant decisions, provided you notify the individual, accept representations, provide genuine human intervention and allow a contest. This guide sets out the two-part test, what the ICO now means by meaningful human involvement, the special category data rules that did not relax, where automated decisions hide inside ordinary business software, the EU divergence that catches exporters, the evidence pack a regulator will ask for, seven failure patterns and a 60-day plan.
