Skip to main content
Home

Automated decision-making, including profiling

Contents

We are consulting on the Data (Use and Access) Act updates to this guidance.

The previous version of this ADM guidance is available as a PDF. We will withdraw this when we’ve finalised the updated guidance after the consultation.

Latest updates - 31 March 2026

31 March 2026 - We have updated this draft guidance to reflect changes to the UK GDPR following the Data (Use and Access) Act 2025 (DUAA).

  • We’ve added content about how you can determine whether the processing you undertake falls within the scope of the UK GDPR’s article 22A provisions that relate to solely automated decisions with significant effects. We use the short-hand automated decision-making (ADM) across this guidance when we refer to this kind of processing.
  • We’ve also clarified when your ability to undertake ADM has certain restrictions and what conditions you must satisfy in these cases.
  • We’ve created a new section about the safeguards you must put in place, as well as the rights people have about the ADM that affects them.

 

 

About this guidance

These chapters sit alongside our brief guidance and provide more detailed guidance for organisations on ADM, including profiling. 

If you haven’t yet read the brief guidance, read that first. It introduces this topic and sets out the key points you need to know.

When we use the term ‘ADM’ in this guidance, we specifically refer to automated decision-making as defined in article 22A of the UK GDPR. This is where a decision:

  • is “based solely on automated processing”, including profiling (ie there is no meaningful human involvement in the decision); and
  • has a “legal or similarly significant effect” on a person (which the UK GDPR refers to as a 'significant decision').

We also use the term ‘the ADM provisions’ to describe articles 22A-22D of the UK GDPR.

Read this detailed guidance if you have questions not answered in the brief guidance, or if you need more information to help you apply the rules relating to ADM in practice.

This guidance will inform the statutory code of practice on artificial intelligence (AI) and ADM that we will develop.     

Why have you produced this guidance?

The purpose of this guidance is to help organisations understand and meet your obligations when you carry out ADM. It explains the relevant provisions of the UK GDPR and provides advice on good practice. Read it to understand the law, our interpretation, and recommendations for compliance.

This guidance is not an exhaustive manual. It focuses on the ADM provisions. While it addresses the key considerations, you remain responsible for ensuring you comply with any other provisions that apply to your processing, as well as any other applicable laws and regulations.

Who is this guidance for?

This guidance is aimed at you if you are planning to carry out ADM. This includes deploying in-house-developed ADM tools or solutions offered by external vendors.

This guidance is aimed at data protection officers, compliance professionals, and technical leads with oversight of your organisation’s use or procurement of ADM systems.

The DPA 2018 contains similar provisions in part 3 (law enforcement processing) and part 4 (intelligence services processing). This guidance is specifically about the ADM provisions in the UK GDPR. If part 3 or part 4 apply to your processing, read our guide to law enforcement processing or our guide to intelligence services processing. 

 

Contents

What is ADM?

What does the UK GDPR say about ADM?

How do we carry out ADM lawfully?

When can we use special category data in our ADM?

What are the ADM safeguards?

What rights do people have?

What else do we need to consider?