Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what safeguards have been implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review, and challenge.

To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.

The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.

Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.