United Kingdom: Data (Use and Access) Act 2025

United KingdomLegislationApplicable

The Data (Use and Access) Act 2025 reforms the United Kingdom data protection and information governance framework, amending the UK General Data Protection Regulation and the Data Protection Act 2018. Warden Watch focuses specifically on Section 80 of the Act, which substitutes UK GDPR Article 22 with new Articles 22A through 22D and updates Part 3 of the 2018 Act regarding automated decision-making. The Act replaces the previous blanket prohibition on solely automated significant decisions with a permissive regime for non-sensitive personal data, subject to mandatory safeguards. These safeguards require controllers to notify individuals of solely automated significant decisions, allow representations, provide meaningful human intervention, and offer the ability to contest outcomes. Strict restrictions remain where automated decisions involve special category data, which continue to require explicit consent, contract necessity, or statutory authorization under Article 9(2)(g). The Act also clarifies when human involvement is meaningful and does not restrict automated screening where substantive human judgment is exercised.

Impact

What this means for HR and vendors

HR and recruitment teams

HR teams and recruiters in the UK may deploy solely automated tools across hiring, workforce scheduling, and talent assessment more broadly, provided those decisions do not rely on special category data. Organizations must implement clear operational workflows to inform affected candidates or employees when solely automated decisions occur. Employers should establish straightforward channels enabling individuals to submit representations, request human review, and contest automated outcomes. Where organizations use automated screening tools, HR must ensure human involvement is meaningful rather than a superficial sign-off, or ensure Article 22C safeguards are fully active.

HR technology vendors

HR technology providers supplying automated recruitment, screening, or workforce management tools to UK employers benefit from greater legal certainty for automated workflows. Providers do not bear direct statutory liability under Article 22C, but must design systems that enable employer deployers to satisfy mandatory safeguards. Platforms should provide automated notification mechanisms, log whether decisions were solely automated or involved meaningful human oversight, and enable human operators to intervene, review profiles, and overturn automated outputs. Systems handling special category data must maintain configurable controls to restrict solely automated processing without verified exceptions.

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerProhibited Practices

Provider Support for Deployer Automated Decision Safeguards

OBLIGATION

APPLIES TO

STATUS

Keep up with changes to employment AI rules and cases.

Get an email when we add important regulation or litigation, or when a tracked matter materially changes.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.

HR and recruitment teams

HR technology vendors

Restrictions on Solely Automated Decisions Involving Special Category Data

Mandatory Safeguards for Solely Automated Significant Decisions

Post-Decision Transparency and Notification

Meaningful Human Oversight Assessment

Provider Support for Deployer Automated Decision Safeguards

Keep up with changes to employment AI rules and cases.

Manage Consent Preferences