Does the new law remove restrictions on automated decisions?
It widens the circumstances in which some significant automated decisions can be made; it does not remove safeguards. DUAA replaced the former Article 22 framework with Articles 22A–22D. A solely automated decision involves no meaningful human involvement; a significant decision has legal or similarly significant effects. Restrictions remain tighter where special-category information is involved. DUAA explanatory notes, section 80.
The regulator explains that safeguards include informing the person about the decision and enabling representations, human intervention and challenges. The changes do not mean an agency can treat any use of customer information as automatically permissible. ICO explanation of the changes. (legislation.gov.uk)
Buyer implication: distinguish administrative assistance from decisions affecting someone’s access to services or opportunities. These are recommended risk-screening categories, not automatic legal classifications:
| Proposed workflow | Recommended approval approach |
|---|---|
| Summarise an enquiry for an office employee | Check accuracy, necessity and access permissions. |
| Offer available appointment choices | Restrict the system to validated diary and service-area rules. |
| Reject an applicant for an engineer vacancy | Require a specific automated-decision assessment and meaningful challenge route. |
| Refuse a vulnerable customer’s request or determine access to a service | Obtain legal and operational review before delegating the decision. |
| Use health information to prioritise customers | Review special-category processing and decision-making separately. |
Recruitment deserves attention if an agency proposes extending beyond customer service: the ICO’s March 2026 work specifically called on employers to review automated hiring decisions and safeguards. ICO recruitment update, 31 March 2026.
Acceptance question: Can the supplier show who can change a decision, what evidence that person sees, and how the customer or applicant requests intervention? A human name on a diagram is not a sufficient procurement answer.
What must the privacy-complaints process do now?
Since 19 June 2026, organisations must give people a clear way to complain about personal-data handling, acknowledge complaints within 30 days, investigate appropriately and communicate the outcome. The 30-day requirement is an acknowledgement deadline—not a universal promise to finish every investigation within that period. ICO complaints announcement. (ico.org.uk)
Recommended implementation:
- Let a caller or message recipient raise a privacy concern without navigating a sales funnel.
- Create a complaint record and assign a named employee.
- Preserve the relevant transcript, message, permissions and workflow version.
- Separate a marketing objection, access request and complaint rather than treating them as interchangeable.
- Make unresolved cases visible to management.
For regulatory-contact records, note that DSIT records the transfer of functions to the new Information Commission from 30 September 2026. This report uses the publisher name shown on the cited ICO guidance. DSIT commencement update.
Sources cited on this page
- DUAA explanatory notes, section 80 ↗www.legislation.gov.uk
- ICO explanation of the changes ↗ico.org.uk
- ICO recruitment update, 31 March 2026 ↗ico.org.uk
- ICO complaints announcement ↗ico.org.uk
- DSIT commencement update ↗www.gov.uk