UK GDPR and the new Articles 22A-D: your rights around automated decisions

On 5 February 2026, Section 80 of the Data (Use and Access) Act 2025 (DUAA) replaced Article 22 of the UK GDPR with new Articles 22A to 22D, this is the single most significant change to UK automated-decision rights since Brexit, and it postdates most of what employers were told when many workplace AI tools were first rolled out. The previous Article 22 operated as a near-prohibition on decisions based solely on automated processing that produce legal or similarly significant effects, permitting them only under narrow exceptions (your explicit consent, contractual necessity, or authorisation by law). The new framework is more permissive: solely automated decisions with significant effects, automated job application rejection, AI-generated performance ratings that trigger disciplinary action, algorithmic redundancy selection, AI-driven pay decisions, are now generally permitted, provided your employer gives you specified safeguards (DUAA, section 80).

Those safeguards are: being informed that an automated decision has been made about you; a way to make representations about the decision; the right to request meaningful human intervention; and the right to contest the decision. "Meaningful human involvement" remains a real, substantive requirement under the new regime too, rubber-stamping an AI recommendation without genuinely reviewing it does not satisfy it, and the ICO has been explicit that human review must be real. The stronger, near-prohibition regime from the old Article 22 is preserved only where the decision is based on special category data (health, disability-related and other sensitive data), which is less common in ordinary hiring or performance decisions but directly relevant to disability-related adjustments or health-related absence management.

To exercise these rights, write to your employer's Data Protection Officer or HR department. There is no prescribed form, a clear written request is sufficient.

The ICO ran a public consultation on updated automated decision-making guidance reflecting these changes from 31 March to 29 May 2026, with final guidance still pending as of mid-2026, so check for the updated version rather than relying only on older guidance written under the old Article 22. ICO, ADM guidance consultation.

The Equality Act 2010 and AI discrimination

The Equality Act 2010 protects you from discrimination based on nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation. These protections apply fully to AI-driven employment decisions.

Two types of discrimination are particularly relevant to AI:

Direct discrimination occurs when you are treated less favourably because of a protected characteristic. This is rare in AI systems but can occur if protected characteristics are used as inputs.

Indirect discrimination occurs when a policy or practice that appears neutral puts people with a protected characteristic at a particular disadvantage and cannot be objectively justified. This is the more common AI discrimination issue, a hiring algorithm that favours applicants from certain postcodes may disproportionately exclude ethnic minorities. The employer must show the practice is a proportionate means of achieving a legitimate aim. If it cannot, it is unlawful.

If you believe AI discrimination has affected you, you can: raise a grievance with your employer; file a claim in the Employment Tribunal (time limits are strict, 3 months less one day from the discriminatory act, extending to six months for acts occurring on or after 1 October 2026 under the Employment Rights Act 2025); contact the Equality and Human Rights Commission; or seek legal advice. Many employment solicitors offer free initial consultations.

Your right to know: transparency under UK GDPR

Under Articles 13 and 14 of the UK GDPR, your employer must tell you, typically in a privacy notice, if your personal data is used in automated decision-making, including AI, and provide meaningful information about the logic involved. "Meaningful information" means more than a generic reference to AI, it should explain the factors the system considers and how they influence the outcome.

You also have the right of access under Article 15, you can request a copy of your personal data held by your employer, including data used in AI-driven assessments. Your employer must respond within one month. This can be a powerful tool: if an AI system used your data to make an employment decision, your subject access request can reveal what data was used and how.

Workplace monitoring: what your employer can do

UK law does not prohibit workplace monitoring but places significant constraints on it. The ICO's Employment practices and data protection: monitoring workers guidance, published in October 2023 to replace the monitoring chapter of the old Employment Practices Code, sets out the key principles.

Your employer must: have a legal basis for processing your personal data collected through monitoring; inform you in advance what monitoring takes place and why (typically through a monitoring policy); carry out a legitimate interests assessment or, for high-risk monitoring, a Data Protection Impact Assessment; and ensure monitoring is proportionate to the purpose.

Covert monitoring, monitoring without telling you, is only lawful in exceptional circumstances involving a specific, serious suspected crime and where telling you would prejudice the investigation. Routine covert AI monitoring of employees is not lawful under UK GDPR.

The Regulation of Investigatory Powers Act 2000 (RIPA) restricts interception of communications. Emails and messages on employer systems are generally covered by a lawful business practice exception, but your employer must have a clear and documented policy.

Trade union rights and algorithmic management

The Trade Union and Labour Relations (Consolidation) Act 1992 (TULRCA) protects your right to be a member of a trade union and to take part in trade union activities. Your employer cannot use AI surveillance to identify union organisers or monitor protected union activity, and cannot dismiss or disadvantage you for union membership or activities.

Where a recognised trade union exists, AI governance is increasingly becoming a subject for collective bargaining. Unite has developed a model AI clause for use in collective agreements covering algorithmic management, AI-driven performance monitoring, and transparency rights, such as Unite's guide and model AI agreement for officers and representatives. If you are in a unionised workplace, your union may have negotiated specific protections.

Employment Rights Act 1996: unfair dismissal and AI

If you have two years' continuous employment, you are protected against unfair dismissal. If an employer uses AI to identify you for disciplinary action or redundancy, they must still follow a fair procedure, investigation, notice, right to be accompanied, appeal. An AI-generated recommendation that triggers dismissal without a genuine procedural process is likely unfair dismissal regardless of whether the AI was "right".

The Employment Tribunal has jurisdiction over unfair dismissal claims. You must file within 3 months less one day of dismissal (subject to early ACAS conciliation); this limit is due to extend to six months for dismissals occurring on or after 1 October 2026, as set out below. Compensation is uncapped in discrimination cases; for unfair dismissal, the basic award is calculated using age and length of service, with a compensatory award capped at the lower of 52 weeks' gross pay or £118,223 (for dismissals on or after 6 April 2025), rising to £123,543 for dismissals on or after 6 April 2026.

The Employment Rights Act 2025

The Employment Rights Bill, introduced October 2024, received Royal Assent on 18 December 2025 as the Employment Rights Act 2025. As enacted, section 25 reduces the qualifying period for ordinary unfair dismissal from two years to six months, rather than creating the day-one right originally proposed in the Bill, and this change is due to come into force on 1 January 2027. Employers should prepare now: any employee hired from July 2026 onwards will reach six months' service on 1 January 2027 and acquire unfair dismissal protection from that date.

The Act is also extending the standard time limit for bringing most Employment Tribunal claims, including unfair dismissal and discrimination claims, from three months to six months, for claims where the relevant act, dismissal, or detriment occurs on or after 1 October 2026. Claims relating to earlier acts remain subject to the three-month time limit. See the government's implementation timeline for current commencement dates.

Practical steps if you think your rights have been breached

Raise a formal grievance with your employer in writing, this preserves your position and creates a record. Contact ACAS (acas.org.uk) for free, impartial advice, early conciliation through ACAS is required before most Employment Tribunal claims. Submit a subject access request for your personal data including any AI-generated assessments. Seek employment law advice, many solicitors offer fixed-fee or no-win-no-fee arrangements for discrimination and unfair dismissal claims. Contact the ICO (ico.org.uk) if your concern is about data protection rather than employment law, the ICO can investigate and issue enforcement notices.

Related reading

Further reading: ICO AI guidance