On 31 March 2026, the Information Commissioner’s Office (ICO) published draft guidance on automated decision-making (ADM), including profiling. The draft guidance follows significant reforms to the automated decision making provisions in UK GDPR that were introduced under the Data (Use and Access) Act 2025 (DUAA). The draft guidance provides more detail on how the ICO is intending to interpret the new provisions and is intended to help organisations ensure they are using ADM lawfully.
ADM is increasingly used across sectors – from recruitment and financial services to personalised customer experiences. While these technologies offer clear efficiencies, the ICO emphasises that they also present risks, particularly around transparency, fairness, and individuals’ ability to understand and challenge decisions affecting them. The ICO separately published a report on the use of ADM in recruitment, which we summarise in this post .
From prohibition to safeguards
Previously UK GDPR said that ADM that produces legal or similarly significant effects was prohibited unless the controller had the consent of the data subject, the ADM was necessary for the performance of a contract with the data subject, or it was authorised by law.
That general prohibition is now set out in Article 22B and applies only where such decisions are made using special category data and now permits such ADM where:
- the controller has explicit consent from the data subject; or
- the processing is necessary for the performance of a contract between the controller and the data subject or is required or authorised by law and in either case is in the substantial public interest (as set out in Schedule 1 of the Data Protection Act 2018).
Organisations therefore have more scope to use ADM and can now rely on any lawful basis (including legitimate interests) to carry out ADM, if they are not using special category data to make the decision. However, UK GDPR now includes a recast set of safeguards that apply to all ADM that has a legal or similarly significant effect.
When does UK GDPR apply to ADM?
ADM and profiling
Organisations should first determine whether their processing falls within scope of the ADM provisions. The UK GDPR applies the ADM provisions where:
- a system is used to make a decision about an individual;
- the decision is solely automated; and
- the decision produces a legal or similarly significant effect.
The draft guidance also expressly addresses profiling, which involves analysing personal data to evaluate aspects relating to an individual (for example, behaviour or preferences). In practice, many ADM systems incorporate profiling, meaning both concepts should be considered together rather than in isolation.
What is a “significant” decision?
Not every automated outcome constitutes a decision, nor is every decision “significant”. A significant decision is one which:
- produces a legal effect; or
- has a similarly significant effect on an individual.
The ICO adopts a contextual approach. What is significant for one individual may not be significant for another, which can create challenges for organisations operating at scale.
The draft guidance recognises this and provides that, where it is difficult to distinguish which decisions will have a significant effect, safeguards should be applied more broadly to relevant decisions. Where uncertainty remains, additional factors should be considered, such as how a person’s financial position or employment opportunities have been affected.
Solely automated decisions and meaningful human involvement
Under the UK GDPR, a decision is “solely automated” where it is made without meaningful human involvement. The draft guidance provides further clarity on this concept. For human involvement to be considered meaningful, it must:
- be active;
- be carried out by an individual with sufficient authority and competence;
- involve the ability to influence, challenge or change the outcome; and
- take place before the decision is finalised and applied.
The draft guidance also highlights the importance of ensuring individuals carrying out reviews are appropriately trained and requires consideration of all relevant factors, not solely the automated output. The draft guidance also places emphasis on maintaining appropriate records of the review process.
The extent to which a decision relies on profiling should also be considered when assessing whether meaningful human involvement is present. For example, in its report on the use of ADM in recruitment, the ICO expresses concern that some hiring managers are placing undue reliance on the output of IT systems and therefore there is not in practice any meaningful human involvement in the decision.
Organisations using AI and other systems should therefore ensure that they provide staff with clear guidance and training on how those systems should be used and the responsibilities of staff.
Lawful processing
Organisations must also ensure that processing using ADM is lawful. The UK GDPR principles require processing to be lawful, fair, and transparent.
A lawful basis must be identified and documented under Article 6. The ICO suggests that the most relevant bases in an ADM context are likely to be:
- Contract: where processing is necessary to perform a contract or take steps at the individual’s request;
- Public task: where processing is necessary for a task carried out in the public interest or in the exercise of official authority; or
- Legitimate interests: requiring a balancing exercise between organisational interests and the rights of the individual.
Where reliance is placed on legitimate interests, a legitimate interest’s assessment should be carried out and documented. It is also necessary to ensure that the use of ADM is necessary and proportionate. Where the same objective can reasonably be achieved through less intrusive means, reliance on ADM is unlikely to be appropriate.
If none of the legal bases above apply, then the organisation may consider relying upon consent, but in many cases, it may be difficult to obtain valid consent, given the imbalance between the organisation and the data subject and the fact that the data subject may not have any real choice.
Transparency remains central. Organisations should clearly explain that ADM is being used, how decisions are made, and the likely consequences for individuals.
Special category data
Where ADM involves special category data, additional restrictions apply. As summarised above, processing is only permitted where authorised under Article 22B.
ADM safeguards
The UK GDPR sets out a number of safeguards which must be implemented when carrying out ADM. Individuals must be able to:
- Receive information about the decision;
- Make representations;
- Obtain human intervention; and
- Contest the decision.
The information provided must be clear; accessible, and meaningful. The information provided should include the factors contributing to the decision, whether profiling was involved, and whether any third-party input influenced the outcome. Again, organisations will need to think about their internal processes for implementing these safeguards, including ensuring that staff understand the rights of data subjects and how human intervention will operate in practice.
The draft guidance highlights that individuals should be informed about ADM at key stages, including:
- When personal data is first collected;
- When the individual exercises access rights; and
- When ADM is being carried out in practice.
Organisations should therefore ensure that the transparency obligations are built into their internal processes and engagement with data subjects to ensure that they are provided with the appropriate information at each stage in the process.
More information
You can access the draft guidance and consultation on the ICO website . The consultation closes on 29 May 2026.
If you would like to discuss the ICO’s draft guidance or your organisation’s use of ADM in further detail, please contact Martin Sloan or Ussamah Nasar.
