Question to the Home Office:

To ask the Secretary of State for the Home Department, on what date the Inter-Ministerial Group on drugs (a) last met and (b) will next meet.

Answered by Sarah Jones - Minister of State (Home Office)

The Drugs Strategy Ministerial Forum (DSMF) brings together Ministers from six departments (the Home Office, the Department for Health and Social Care, the Ministry of Justice, the Department of Work and Pensions, the Department for Education and the Ministry of Housing Communities and Local Government), along with other departments as appropriate, to ensure cross-government accountability and join-up on a range of drug-related activity.

The last DSMF was held in December, and the next meeting is being planned for the autumn.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, what steps his Department is taking to help ensure compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

The Ministry of Defence (MOD) has firmly established policies, guidance, and governance arrangements in place to ensure compliance with data protection legislation when processing special category personal data. These arrangements require that personal data be processed lawfully, fairly, and securely, and only where an appropriate condition for processing applies. They also require business areas to identify and implement suitable safeguards.

In addition, the MOD’s Data Protection Impact Assessment process mandates a thorough assessment of privacy risks where processing is likely to pose a high risk to individuals, including cases involving special category personal data, to ensure risks are identified and mitigated before processing begins.

These measures are supported by advice and oversight from Principal Data Protection Authorities within MOD and the MOD’s Data Protection Officer’s Team, alongside mandatory training, guidance, and assurance activities across the Department.

Question to the Department for Transport:

To ask the Secretary of State for Transport, what measures are in place to ensure that human oversight is substantive and effective, rather than limited to formal or nominal review.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

Where the Department uses automated decision-making systems that process personal data, these processing activities are required to be assessed via the completion of a Data Protection Impact Assessment to support compliance with data protection law and associated guidance. This process is used to identify and mitigate any risk of bias and discrimination and assess the effectiveness of human oversight.

Question to the Department for Transport:

To ask the Secretary of State for Transport, what steps has the Department taken to assess and mitigate risks of bias or discrimination arising from the use of automated decision-making systems.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

Where the Department uses automated decision-making systems that process personal data, these processing activities are required to be assessed via the completion of a Data Protection Impact Assessment to support compliance with data protection law and associated guidance. This process is used to identify and mitigate any risk of bias and discrimination and assess the effectiveness of human oversight.

Question to the Department for Transport:

To ask the Secretary of State for Transport, to what extent are automated decision-making systems used in relation to civil service employment, including recruitment, performance management, discipline, or allocation of work.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Department is not using automated decision-making systems in relation to civil service employment, including recruitment, performance management, discipline or the allocation of work.

Question to the Department for Transport:

To ask the Secretary of State for Transport, what consultation has taken place with recognised trade unions regarding the introduction or use of automated decision-making systems affecting staff.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Department holds regular consultations with its trade unions on all matters concerning the workforce, including its future strategy for the use of Artificial Intelligence.

Question to the Department for Transport:

To ask the Secretary of State for Transport, what steps she is taking to help ensure compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

All processing of personal data, including special category data, within the Department is screened to identify whether it is likely to result in a high risk to the rights and freedoms of individuals. Where high-risk processing is identified, a Data Protection Impact Assessment is completed to support compliance with data protection law and associated guidance.

Question to the Department for Transport:

To ask the Secretary of State for Transport, how does the Department define and ensure meaningful human involvement in decisions supported or made by automated systems.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

What constitutes meaningful human involvement will vary depending on the specific use case, so the Department considers and assesses the nature of human involvement in decisions supported or made by automated decisions on a case-by-case basis supported by relevant guidance.

The Department has developed guidance on Responsible Artificial Intelligence (AI) usage for staff and follows the AI Playbook for UK Government that requires us to have meaningful human control at the right stages, including human validation of any high-risk decisions influenced by AI and having strategies for meaningful intervention.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, whether significant Automated Decision-Making is taking place or planned within his Department, and if he will make a statement.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

There are different interpretations of what constitutes Automated Decision-Making (ADM). The Ministry of Defence (MOD) does not hold a central database on all activities that might meet the definition of ADM within the Department

We have robust policies and guidance on ADM. As Artificial Intelligence (AI) and similar technologies become more prevalent within our business, we also have policies and guidance on AI which apply in addition to our data policies, and which stress the importance of human accountability as a key aspect of responsible use.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, what steps his Department has taken to assess and mitigate risks of bias or discrimination arising from the use of automated decision-making systems.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

Within the Ministry of Defence (MOD), decisions supported by automated systems which involve personal data and produce significant effects are subject to appropriate human oversight and review. The MOD’s Data Protection Impact Assessment process identifies, assesses and mitigates risks to individuals by evaluating individual risks and ensuring suitable technical and organisational safeguards are in place before data processing begins. This includes addressing risks around bias, unfairness and discrimination. MOD business areas are required to consider the impact of automated processing to ensure decisions are fair and lawful.

MOD personnel involved in operating and overseeing automated systems receive mandatory data protection alongside learning modules addressing bias and discrimination. MOD guidance concerning Data Protection Impact Assessments mandates that staff understand how automated decision-making tools function, the decision criteria used and how to detect and address potential bias or unfair outcomes.

Question to the Department for Transport:

To ask the Secretary of State for Transport, what safeguards she has implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review and challenge in the context of the Data (Use and Access) Act 2025.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Department's Personal Information Charter sets out how individuals will be informed about decisions that have been made partially or wholly by automated means, the safeguards, and the information rights that apply.

The Department also has an internal data protection policy which was updated to reflect the changes introduced by the Data (Use and Access) Act 2025 and provides guidance to the Department on its obligations when using automated decision making.

Question to the Department for Transport:

To ask the Secretary of State for Transport, what processes are in place to enable individuals to seek human review and to challenge decisions made by automated systems in the context of the Data (Use and Access) Act 2025.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Department's Personal Information Charter sets out how individuals will be informed about decisions that have been made partially or wholly by automated means, the safeguards, and the information rights that apply.

The Department also has an internal data protection policy which was updated to reflect the changes introduced by the Data (Use and Access) Act 2025 and provides guidance to the Department on its obligations when using automated decision making.

Question to the Department for Transport:

To ask the Secretary of State for Transport, how individuals are informed that decisions have been taken in (a) whole and (b) part by automated means in the context of the Data (Use and Access) Act 2025.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Department's Personal Information Charter sets out how individuals will be informed about decisions that have been made partially or wholly by automated means, the safeguards, and the information rights that apply.

The Department also has an internal data protection policy which was updated to reflect the changes introduced by the Data (Use and Access) Act 2025 and provides guidance to the Department on its obligations when using automated decision making.

Question to the Department for Transport:

To ask the Secretary of State for Transport, given the passage of the Data (Use and Access) Act 2025 what internal guidance her Department issued on the potential impact of the Data (Use and Access) Act 2025 on automated decision-making.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Department's Personal Information Charter sets out how individuals will be informed about decisions that have been made partially or wholly by automated means, the safeguards, and the information rights that apply.

The Department also has an internal data protection policy which was updated to reflect the changes introduced by the Data (Use and Access) Act 2025 and provides guidance to the Department on its obligations when using automated decision making.

Question to the Department for Transport:

To ask the Secretary of State for Transport, whether significant Automated Decision-Making is taking place or planned within her Department, and if she will make a statement.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Driver and Vehicle Licensing Agency uses automated processes based on the information held on their records to generate penalty letters to those vehicle keepers who have failed to meet their obligations relating to the registration, licensing and insurance of vehicles. All letters generated explain what recipients should do next and any subsequent contact regarding the penalty, including appeals, is dealt with by an official and is not subject to automated decision making.

There are no other solely automated decisions currently made by the Department that produce legal or similarly significant effects. Any future initiatives involving significant automated decision making would adhere to the relevant guidance and details would be published in accordance with the Algorithmic Transparency Recording Standard.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what steps her Department is taking to ensure compliance with data protection requirements under the Data (Use and Access) Act 2025 relating to the processing of special category data, including data relating to health and protected characteristics.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

All organisations in the UK that process personal data, including government departments, must comply with the UK’s data protection legislation (UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA)). Under the UK GDPR, special category data is personal data that needs more protection because it is sensitive, and so is subject to additional conditions and safeguards.

My department ensures that all processing of special category personal data is undertaken in compliance with data protection legislation. Data Protection Impact Assessments are completed where required and are reviewed by the Data Protection Officer’s team to ensure that special category data is processed only where a valid condition for processing applies, processing is necessary and proportionate, and appropriate technical and organisational safeguards are in place. The Department has published an Appropriate Policy Document on GOV.UK.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, whether her Department maintains a public register or internal inventory of automated decision-making systems.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Government is committed to the safe, ethical and transparent use of algorithmic decision-making and wider algorithmic tools. Transparency is essential to building public trust, enabling accountability, and improving understanding of how algorithms influence decisions and services.

The Department for Science, Innovation and Technology (DSIT) does not maintain a public register or internal inventory of automated decision-making systems. However, DSIT supports transparency through the Algorithmic Transparency Recording Standard (ATRS), which establishes a standardised way for public sector organisations to publish information about how and why they are using algorithmic tools.

The ATRS is mandatory for all government departments, and for ALBs which deliver public or frontline services, or directly interact with the general public. It applies to algorithmic tools which have a significant influence on a decision-making process with public effect or directly interact with the general public.

The scope of the ATRS encompasses many of the most significant uses of automated decision-making and algorithmic tools, and those of the greatest interest to citizens and stakeholders.

The ATRS template, scope and exemptions policy, and the repository of published records are hosted on the ATRS Hub on GOV.UK.

Question to the Department for Transport:

To ask the Secretary of State for Transport, whether the Department maintains a public register or internal inventory of automated decision-making systems.

Answered by Simon Lightwood - Parliamentary Under-Secretary (Department for Transport)

The Government is committed to adopting artificial intelligence in a way that is transparent, responsible and accountable to the public.

Information about algorithmic and AI tools used by government departments to support decisions that affect members of the public, or that have a significant influence on a decision-making process with public effect, is published through the Algorithmic Transparency Recording Standard (ATRS). The ATRS has been mandatory for central government departments since 2024, and records are published on GOV.UK at www.gov.uk/algorithmic-transparency-records .

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, to what extent are automated decision-making systems used in relation to civil service employment, including recruitment, performance management, discipline, or allocation of work.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what measures are in place to ensure that human oversight is substantive and effective, rather than limited to formal or nominal review.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what consultation has taken place with recognised trade unions regarding the introduction or use of automated decision-making systems affecting staff.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what steps has the Department taken to assess and mitigate risks of bias or discrimination arising from the use of automated decision-making systems.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what safeguards she has implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review and challenge in the context of the Data (Use and Access) Act 2025.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what processes are in place to enable individuals to seek human review and to challenge decisions made by automated systems in the context of the Data (Use and Access) Act 2025.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, how individuals are informed that decisions have been taken in (a) whole and (b) part by automated means in the context of the Data (Use and Access) Act 2025.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, what internal guidance her Department has issued on the potential impact of the Data (Use and Access) Act 2025 on automated decision-making.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, whether significant Automated Decision-Making is taking place or planned within her Department, and if she will make a statement.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Department for Science, Innovation & Technology:

To ask the Secretary of State for Science, Innovation and Technology, how does the Department define and ensure meaningful human involvement in decisions supported or made by automated systems.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, how does the Department define and ensure meaningful human involvement in decisions supported or made by automated systems.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

Within the Ministry of Defence (MOD), in relation to decisions supported or made by automated systems which involve personal data, meaningful human involvement requires that automated outputs undergo thorough and appropriate human review. This includes ensuring that such outputs do not constitute the sole basis for any significant decisions impacting individuals unless there is a lawful basis for such processing and all relevant statutory safeguards are fully implemented. The MOD’s Data Protection Impact Assessment process is used to assess risks and ensure that appropriate safeguards are in place.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, what processes are in place to enable individuals to seek human review and to challenge decisions made by automated systems in the context of the Data (Use and Access) Act 2025.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

The Ministry of Defence (MOD)’s public Privacy Notice explains when personal data may be used in Automated Decision Making (ADM), the rights available to individuals, and how concerns can be raised.

Where the law requires, individuals affected by decisions made solely through automated means have the right to request a human review or reconsideration of those decisions. If this right is denied, the MOD’s data protection framework provides mechanisms for individuals to challenge the processing activity and submit complaints. Complaints can be directed to the MOD Data Protection Officer’s Team, which is responsible for ensuring compliance with data protection legislation and addressing concerns related to the handling of personal data, including ADM.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, what safeguards he has implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review and challenge in the context of the Data (Use and Access) Act 2025.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

The Ministry of Defence (MOD) has issued internal guidance on the implementation of the Data (Use and Access) Act 2025, specifically addressing provisions related to Automated Decision Making (ADM). The guidance requires the following safeguards when ADM is employed:

• Informing individuals about the use of automated decision-making

• Providing access to human review and challenge where legally required

• Conducting Data Protection Impact Assessments to identify and mitigate risks to individuals before introducing new ADM processes.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, what internal guidance his Department has issued on the potential impact of the Data (Use and Access) Act 2025 on automated decision-making.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

In addition to the Ministry of Defence (MOD)’s public Privacy Notice, which explains the circumstances in which the Department may use Automated Decision Making (ADM) involving personal data, the MOD has issued internal guidance on the implementation of the Data (Use and Access) Act 2025. This guidance covers the Act’s provisions relating to ADM, including the circumstances in which automated decision-making may be used and the safeguards that must be applied to protect individuals’ rights. The guidance has been developed alongside, and is consistent with, the Information Commissioner’s Office guidance on the Data (Use and Access) Act 2025 and automated decision-making.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, how individuals are informed that decisions have been taken in (a) whole and (b) part by automated means in the context of the Data (Use and Access) Act 2025.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

The Ministry of Defence (MOD) ensures compliance with legal requirements regarding Automated Decision-Making (ADM) through a range of measures. The MOD provides clear information about its use of ADM in its public Privacy Notice. When personal data is processed through ADM, individuals are informed in accordance with applicable data protection legislation and MOD internal policies. The public Privacy Notice details the circumstances under which automated decision-making may be employed and outlines the rights available to individuals. In cases where a significant decision is made solely by automated means, individuals are notified prior to the processing and, where required by law, are given the opportunity to request a human review or reconsideration of the decision. The MOD strictly ensures that no individual is subject to decisions producing significant effects based solely on automated decision-making unless there is a lawful basis for such processing and all relevant statutory safeguards are fully implemented. The Data Protection Impact Assessment process is used to assess risks and ensure that appropriate safeguards are in place.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, to what extent are automated decision-making systems used in relation to civil service employment, including recruitment, performance management, discipline, or allocation of work.

Answered by Calvin Bailey - Parliamentary Under-Secretary (Ministry of Defence) (Minister for Veterans and People)

The Ministry of Defence (MOD) engages with Trade Unions on all key matters that impact staff. We have engaged with all recognised Trade Unions where we have pursued automation in systems that impact staff employment and will continue such engagement when future automation is proposed.

The MOD utilises automated decision-making systems to streamline labour-intensive processes and deliver more efficient services. Examples include the processing of annual leave requests on HR systems following management approval and notifying job applicants that they do not meet the nationality requirements for security-sensitive roles, with contact details provided to discuss alternative opportunities. The MOD may also utilise psychometric testing to assess candidates during recruitment, with automated processes generating and communicating the results.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, what consultation has taken place with recognised trade unions regarding the introduction or use of automated decision-making systems affecting staff.

Answered by Calvin Bailey - Parliamentary Under-Secretary (Ministry of Defence) (Minister for Veterans and People)

The Ministry of Defence (MOD) engages with Trade Unions on all key matters that impact staff. We have engaged with all recognised Trade Unions where we have pursued automation in systems that impact staff employment and will continue such engagement when future automation is proposed.

The MOD utilises automated decision-making systems to streamline labour-intensive processes and deliver more efficient services. Examples include the processing of annual leave requests on HR systems following management approval and notifying job applicants that they do not meet the nationality requirements for security-sensitive roles, with contact details provided to discuss alternative opportunities. The MOD may also utilise psychometric testing to assess candidates during recruitment, with automated processes generating and communicating the results.

Question to the Ministry of Defence:

To ask the Secretary of State for Defence, whether the Department maintains a public register or internal inventory of automated decision-making systems; and whether it plans to publish such information.

Answered by Luke Pollard - Minister of State (Ministry of Defence)

There are different interpretations of what constitutes Automated Decision-Making (ADM). The Ministry of Defence does not hold a central database on all activities and systems that might meet the definition of ADM within the Department.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what steps has the Department taken to assess and mitigate risks of bias or discrimination arising from the use of automated decision-making systems.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

Reforms to the solely auromated decision-making (ADM) rules in the Data (Use and Access) Act make clear that these are decisions without any meaningful human involvement. This is to prevent ‘rubber stamping’ of decisions qualifying as having a ‘human in the loop’. To future-proof the legislation, the Act introduced a number of regulation-making powers to ensure the Government can keep these safeguards effective and up to date in light of evolving technology and changing societal expectations.

The ICO as the independent data protection regulator sets out in its guidance that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. The ICO is working on updating its guidance in the light of the recent reforms and is working on a Code of Practice on AI and ADM which will provide authoritative guidance in data protection compliance in this area.

The UK’s data protection legislation does not lay down specific rules regarding particular employment systems. It is for each organisation to determine how it applies the data protection framework in its operational context. Where individuals are subject to significant decisions based solely on automated processing, the legislation provides safeguards including rights to information, challenge and human intervention.

The UK’s data protection legislation is a principles-based framework and does not prescribe specific consultation requirements for particular operational systems. Organisations are responsible for applying the requirements of the legislation within their own operational context and must ensure any processing of personal data complies with applicable legal requirements.

The UK’s data protection legislation applies to any processing of personal data regardless of the technology being used and is underpinned by principles of fairness, transparency and accountability. Organisations using automated decision-making or profiling must ensure processing is fair, lawful and transparent, and may be required to undertake a Data Protection Impact Assessment where processing is likely to result in a high risk to individuals’ rights and freedoms.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, to what extent are automated decision-making systems used in relation to civil service employment, including recruitment, performance management, discipline, or allocation of work.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

Reforms to the solely auromated decision-making (ADM) rules in the Data (Use and Access) Act make clear that these are decisions without any meaningful human involvement. This is to prevent ‘rubber stamping’ of decisions qualifying as having a ‘human in the loop’. To future-proof the legislation, the Act introduced a number of regulation-making powers to ensure the Government can keep these safeguards effective and up to date in light of evolving technology and changing societal expectations.

The ICO as the independent data protection regulator sets out in its guidance that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. The ICO is working on updating its guidance in the light of the recent reforms and is working on a Code of Practice on AI and ADM which will provide authoritative guidance in data protection compliance in this area.

The UK’s data protection legislation does not lay down specific rules regarding particular employment systems. It is for each organisation to determine how it applies the data protection framework in its operational context. Where individuals are subject to significant decisions based solely on automated processing, the legislation provides safeguards including rights to information, challenge and human intervention.

The UK’s data protection legislation is a principles-based framework and does not prescribe specific consultation requirements for particular operational systems. Organisations are responsible for applying the requirements of the legislation within their own operational context and must ensure any processing of personal data complies with applicable legal requirements.

The UK’s data protection legislation applies to any processing of personal data regardless of the technology being used and is underpinned by principles of fairness, transparency and accountability. Organisations using automated decision-making or profiling must ensure processing is fair, lawful and transparent, and may be required to undertake a Data Protection Impact Assessment where processing is likely to result in a high risk to individuals’ rights and freedoms.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what measures are in place to ensure that human oversight is substantive and effective, rather than limited to formal or nominal review.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

Reforms to the solely auromated decision-making (ADM) rules in the Data (Use and Access) Act make clear that these are decisions without any meaningful human involvement. This is to prevent ‘rubber stamping’ of decisions qualifying as having a ‘human in the loop’. To future-proof the legislation, the Act introduced a number of regulation-making powers to ensure the Government can keep these safeguards effective and up to date in light of evolving technology and changing societal expectations.

The ICO as the independent data protection regulator sets out in its guidance that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. The ICO is working on updating its guidance in the light of the recent reforms and is working on a Code of Practice on AI and ADM which will provide authoritative guidance in data protection compliance in this area.

The UK’s data protection legislation does not lay down specific rules regarding particular employment systems. It is for each organisation to determine how it applies the data protection framework in its operational context. Where individuals are subject to significant decisions based solely on automated processing, the legislation provides safeguards including rights to information, challenge and human intervention.

The UK’s data protection legislation is a principles-based framework and does not prescribe specific consultation requirements for particular operational systems. Organisations are responsible for applying the requirements of the legislation within their own operational context and must ensure any processing of personal data complies with applicable legal requirements.

The UK’s data protection legislation applies to any processing of personal data regardless of the technology being used and is underpinned by principles of fairness, transparency and accountability. Organisations using automated decision-making or profiling must ensure processing is fair, lawful and transparent, and may be required to undertake a Data Protection Impact Assessment where processing is likely to result in a high risk to individuals’ rights and freedoms.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what consultation has taken place with recognised trade unions regarding the introduction or use of automated decision-making systems affecting staff.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

Reforms to the solely auromated decision-making (ADM) rules in the Data (Use and Access) Act make clear that these are decisions without any meaningful human involvement. This is to prevent ‘rubber stamping’ of decisions qualifying as having a ‘human in the loop’. To future-proof the legislation, the Act introduced a number of regulation-making powers to ensure the Government can keep these safeguards effective and up to date in light of evolving technology and changing societal expectations.

The ICO as the independent data protection regulator sets out in its guidance that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. The ICO is working on updating its guidance in the light of the recent reforms and is working on a Code of Practice on AI and ADM which will provide authoritative guidance in data protection compliance in this area.

The UK’s data protection legislation does not lay down specific rules regarding particular employment systems. It is for each organisation to determine how it applies the data protection framework in its operational context. Where individuals are subject to significant decisions based solely on automated processing, the legislation provides safeguards including rights to information, challenge and human intervention.

The UK’s data protection legislation is a principles-based framework and does not prescribe specific consultation requirements for particular operational systems. Organisations are responsible for applying the requirements of the legislation within their own operational context and must ensure any processing of personal data complies with applicable legal requirements.

The UK’s data protection legislation applies to any processing of personal data regardless of the technology being used and is underpinned by principles of fairness, transparency and accountability. Organisations using automated decision-making or profiling must ensure processing is fair, lawful and transparent, and may be required to undertake a Data Protection Impact Assessment where processing is likely to result in a high risk to individuals’ rights and freedoms.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what steps his Department is taking to help ensure compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

All organisations in the UK that process personal data, including government departments, must comply with the UK’s data protection legislation (UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA)).

Under the UK GDPR, special category data is personal data that needs more protection because it is sensitive, and so is subject to additional conditions and safeguards.

The Ministry of Justice is committed to ensuring compliance with data protection legislation, including requirements relating to the processing of special category data such as information concerning health or protected characteristics.

The Department has established governance, policies and procedures to support lawful, fair and transparent processing of personal data. This includes the provision of data protection guidance, mandatory training and access to specialist advice from data protection professionals.

Where processing is likely to result in a high risk to individuals’ rights and freedoms, the Department undertakes Data Protection Impact Assessments and implements appropriate technical and organisational measures to safeguard personal data. The Department also maintains arrangements for monitoring compliance, reporting and managing personal data incidents, and reviewing processing activities to ensure they remain compliant with legal requirements.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what safeguards he has implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review and challenge in the context of the Data (Use and Access) Act 2025.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

The UK’s data protection legislation applies to the private and public sector alike. Where significant decisions are taken solely based on automated processing, Departments must provide safeguards including rights to information, challenge and human intervention and comply with the relevant transparency obligations.

The Data (Use and Access) Act 2025 maintains safeguards for individuals who are subject to significant decisions based solely on automated processing. Organisations must provide individuals with the right to contest such decisions, obtain human intervention and make representations to the controller. These safeguards apply where solely automated decision-making (ADM) has legal or similarly significant effects on an individual.

Transparency requirements on organisations apply as soon as organisations obtain individuals’ data for solely ADM. Articles 13-14 of the UK GDPR require organisations to provide data subjects privacy information (usually in a privacy notice) about the existence of solely ADM including profiling, meaningful information about the logic involved, and the significance and the envisaged consequence of such automated processing for the individual.

After a decision has been based solely on automated processing, the reformed Article 22 includes safeguards that must be applied once a legal or similarly significant decision has been made about the data subject. Organisations are required to provide data subjects with information related to significant decisions that have been taken about them based solely on automated processing and enable them to obtain human intervention or challenge a decision.

Where a partly automated decision is taken in which the human input influences the final decision, it is likely that the human input would be considered to be meaningful. Consequently, it would not be necessary to provide the additional safeguards set out under the automated decision-making provisions.

Article 22C of the UK GDPR contains safeguards for solely automated decisions that have legal or similarly significant effects on individuals. Where organisations have made such decisions, must comply with these safeguards which include: providing information about the decision taken, the right for individuals to contest the decision, make representations, and obtain human intervention for the decision.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making, while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what internal guidance his Department has issued on the potential impact of the Data (Use and Access) Act 2025 on automated decision-making.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

The UK’s data protection legislation applies to the private and public sector alike. Where significant decisions are taken solely based on automated processing, Departments must provide safeguards including rights to information, challenge and human intervention and comply with the relevant transparency obligations.

The Data (Use and Access) Act 2025 maintains safeguards for individuals who are subject to significant decisions based solely on automated processing. Organisations must provide individuals with the right to contest such decisions, obtain human intervention and make representations to the controller. These safeguards apply where solely automated decision-making (ADM) has legal or similarly significant effects on an individual.

Transparency requirements on organisations apply as soon as organisations obtain individuals’ data for solely ADM. Articles 13-14 of the UK GDPR require organisations to provide data subjects privacy information (usually in a privacy notice) about the existence of solely ADM including profiling, meaningful information about the logic involved, and the significance and the envisaged consequence of such automated processing for the individual.

After a decision has been based solely on automated processing, the reformed Article 22 includes safeguards that must be applied once a legal or similarly significant decision has been made about the data subject. Organisations are required to provide data subjects with information related to significant decisions that have been taken about them based solely on automated processing and enable them to obtain human intervention or challenge a decision.

Where a partly automated decision is taken in which the human input influences the final decision, it is likely that the human input would be considered to be meaningful. Consequently, it would not be necessary to provide the additional safeguards set out under the automated decision-making provisions.

Article 22C of the UK GDPR contains safeguards for solely automated decisions that have legal or similarly significant effects on individuals. Where organisations have made such decisions, must comply with these safeguards which include: providing information about the decision taken, the right for individuals to contest the decision, make representations, and obtain human intervention for the decision.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making, while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, whether significant Automated Decision-Making is taking place or planned within his Department, and if he will make a statement.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

The UK’s data protection legislation applies to the private and public sector alike. Where significant decisions are taken solely based on automated processing, Departments must provide safeguards including rights to information, challenge and human intervention and comply with the relevant transparency obligations.

The Data (Use and Access) Act 2025 maintains safeguards for individuals who are subject to significant decisions based solely on automated processing. Organisations must provide individuals with the right to contest such decisions, obtain human intervention and make representations to the controller. These safeguards apply where solely automated decision-making (ADM) has legal or similarly significant effects on an individual.

Transparency requirements on organisations apply as soon as organisations obtain individuals’ data for solely ADM. Articles 13-14 of the UK GDPR require organisations to provide data subjects privacy information (usually in a privacy notice) about the existence of solely ADM including profiling, meaningful information about the logic involved, and the significance and the envisaged consequence of such automated processing for the individual.

After a decision has been based solely on automated processing, the reformed Article 22 includes safeguards that must be applied once a legal or similarly significant decision has been made about the data subject. Organisations are required to provide data subjects with information related to significant decisions that have been taken about them based solely on automated processing and enable them to obtain human intervention or challenge a decision.

Where a partly automated decision is taken in which the human input influences the final decision, it is likely that the human input would be considered to be meaningful. Consequently, it would not be necessary to provide the additional safeguards set out under the automated decision-making provisions.

Article 22C of the UK GDPR contains safeguards for solely automated decisions that have legal or similarly significant effects on individuals. Where organisations have made such decisions, must comply with these safeguards which include: providing information about the decision taken, the right for individuals to contest the decision, make representations, and obtain human intervention for the decision.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making, while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, how does the Department define and ensure meaningful human involvement in decisions supported or made by automated systems.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

The Government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture.

Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.

As such, the Government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, what processes are in place to enable individuals to seek human review and to challenge decisions made by automated systems in the context of the Data (Use and Access) Act 2025.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

The UK’s data protection legislation applies to the private and public sector alike. Where significant decisions are taken solely based on automated processing, Departments must provide safeguards including rights to information, challenge and human intervention and comply with the relevant transparency obligations.

The Data (Use and Access) Act 2025 maintains safeguards for individuals who are subject to significant decisions based solely on automated processing. Organisations must provide individuals with the right to contest such decisions, obtain human intervention and make representations to the controller. These safeguards apply where solely automated decision-making (ADM) has legal or similarly significant effects on an individual.

Transparency requirements on organisations apply as soon as organisations obtain individuals’ data for solely ADM. Articles 13-14 of the UK GDPR require organisations to provide data subjects privacy information (usually in a privacy notice) about the existence of solely ADM including profiling, meaningful information about the logic involved, and the significance and the envisaged consequence of such automated processing for the individual.

After a decision has been based solely on automated processing, the reformed Article 22 includes safeguards that must be applied once a legal or similarly significant decision has been made about the data subject. Organisations are required to provide data subjects with information related to significant decisions that have been taken about them based solely on automated processing and enable them to obtain human intervention or challenge a decision.

Where a partly automated decision is taken in which the human input influences the final decision, it is likely that the human input would be considered to be meaningful. Consequently, it would not be necessary to provide the additional safeguards set out under the automated decision-making provisions.

Article 22C of the UK GDPR contains safeguards for solely automated decisions that have legal or similarly significant effects on individuals. Where organisations have made such decisions, must comply with these safeguards which include: providing information about the decision taken, the right for individuals to contest the decision, make representations, and obtain human intervention for the decision.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making, while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

Question to the Ministry of Justice:

To ask the Secretary of State for Justice, how individuals are informed that decisions have been taken in (a) whole and (b) part by automated means in the context of the Data (Use and Access) Act 2025.

Answered by Jake Richards - Parliamentary Under-Secretary (Ministry of Justice)

The UK’s data protection legislation applies to the private and public sector alike. Where significant decisions are taken solely based on automated processing, Departments must provide safeguards including rights to information, challenge and human intervention and comply with the relevant transparency obligations.

The Data (Use and Access) Act 2025 maintains safeguards for individuals who are subject to significant decisions based solely on automated processing. Organisations must provide individuals with the right to contest such decisions, obtain human intervention and make representations to the controller. These safeguards apply where solely automated decision-making (ADM) has legal or similarly significant effects on an individual.

Transparency requirements on organisations apply as soon as organisations obtain individuals’ data for solely ADM. Articles 13-14 of the UK GDPR require organisations to provide data subjects privacy information (usually in a privacy notice) about the existence of solely ADM including profiling, meaningful information about the logic involved, and the significance and the envisaged consequence of such automated processing for the individual.

After a decision has been based solely on automated processing, the reformed Article 22 includes safeguards that must be applied once a legal or similarly significant decision has been made about the data subject. Organisations are required to provide data subjects with information related to significant decisions that have been taken about them based solely on automated processing and enable them to obtain human intervention or challenge a decision.

Where a partly automated decision is taken in which the human input influences the final decision, it is likely that the human input would be considered to be meaningful. Consequently, it would not be necessary to provide the additional safeguards set out under the automated decision-making provisions.

Article 22C of the UK GDPR contains safeguards for solely automated decisions that have legal or similarly significant effects on individuals. Where organisations have made such decisions, must comply with these safeguards which include: providing information about the decision taken, the right for individuals to contest the decision, make representations, and obtain human intervention for the decision.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making, while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

Richard Pengelly

Prohibiting Members of Parliament from having paid second jobs

London South Bank University industrial dispute

Strike action and industrial dispute at Tower Hamlets leisure centres

Durham Miners’ Gala 2026