Question to the HM Treasury:

To ask the Chancellor of the Exchequer, what steps HMRC are taking to ensure compliance with requirements under the Data (Use and Access) Act 2025 relating to (a) automated decision-making and (b) rights to (i) information, (ii) human review, and (iii) challenge.

HMRC has a comprehensive approach to data governance for compliance with requirements under the Data (Use and Access) Act 2025 and other data protection legislation. This includes, for example, requiring the legislative conditions are met for the use of special category data in any automated decisions.

HMRC has published information about its approach to Automated Decision Making as part of its privacy notice available on at, www.gov.uk, by searching for ‘HMRC Privacy Notice’.

HMRC staff are provided with policy and guidance through the internal intranet, including specific guidance on automated decision-making. Staff are also supported through data protection requirements using Data Protection Impact Assessments. HMRC has updated its policies and guidance following changes introduced by the Data (Use and Access) Act 2025.