AI at Work in the UK: Your Rights Under UK GDPR, the Equality Act, and Employment Law

UK GDPR Article 22: your right against solely automated decisions

Article 22 of the UK GDPR gives you the right not to be subject to a decision based solely on automated processing when that decision produces legal or similarly significant effects. This is one of the strongest AI employment rights in the world.

It applies to: automated job application rejection, AI-generated performance ratings that automatically trigger disciplinary action, algorithmic redundancy selection without human review, and AI-driven pay decisions. "Solely automated" means there was no meaningful human involvement — rubber-stamping an AI recommendation without genuinely reviewing it does not satisfy the requirement for human oversight. The ICO is explicit on this: the human review must be real.

Where Article 22 applies, you have three rights: the right to request human review of the decision; the right to express your point of view; and the right to obtain an explanation of the decision. To exercise these rights, write to your employer's Data Protection Officer or HR department. There is no prescribed form — a clear written request is sufficient.

Employers can rely on limited exceptions to Article 22 — including where the automated decision is necessary for entering into or performing a contract, or is based on your explicit consent. Employment decisions often invoke the contractual necessity exception. But even where an exception applies, you still have the right to human review and the right to contest the decision.

The Equality Act 2010 and AI discrimination

The Equality Act 2010 protects you from discrimination based on nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation. These protections apply fully to AI-driven employment decisions.

Two types of discrimination are particularly relevant to AI:

Direct discrimination occurs when you are treated less favourably because of a protected characteristic. This is rare in AI systems but can occur if protected characteristics are used as inputs.

Indirect discrimination occurs when a policy or practice that appears neutral puts people with a protected characteristic at a particular disadvantage and cannot be objectively justified. This is the more common AI discrimination issue — a hiring algorithm that favours applicants from certain postcodes may disproportionately exclude ethnic minorities. The employer must show the practice is a proportionate means of achieving a legitimate aim. If it cannot, it is unlawful.

If you believe AI discrimination has affected you, you can: raise a grievance with your employer; file a claim in the Employment Tribunal (time limits are strict — 3 months less one day from the discriminatory act); contact the Equality and Human Rights Commission; or seek legal advice. Many employment solicitors offer free initial consultations.

Your right to know: transparency under UK GDPR

Under Articles 13 and 14 of the UK GDPR, your employer must tell you — typically in a privacy notice — if your personal data is used in automated decision-making, including AI, and provide meaningful information about the logic involved. "Meaningful information" means more than a generic reference to AI — it should explain the factors the system considers and how they influence the outcome.

You also have the right of access under Article 15 — you can request a copy of your personal data held by your employer, including data used in AI-driven assessments. Your employer must respond within one month. This can be a powerful tool: if an AI system used your data to make an employment decision, your subject access request can reveal what data was used and how.

Workplace monitoring: what your employer can do

UK law does not prohibit workplace monitoring but places significant constraints on it. The ICO's Employment Practices: Monitoring at Work guidance sets out the key principles.

Your employer must: have a legal basis for processing your personal data collected through monitoring; inform you in advance what monitoring takes place and why (typically through a monitoring policy); carry out a legitimate interests assessment or, for high-risk monitoring, a Data Protection Impact Assessment; and ensure monitoring is proportionate to the purpose.

Covert monitoring — monitoring without telling you — is only lawful in exceptional circumstances involving a specific, serious suspected crime and where telling you would prejudice the investigation. Routine covert AI monitoring of employees is not lawful under UK GDPR.

The Regulation of Investigatory Powers Act 2000 (RIPA) restricts interception of communications. Emails and messages on employer systems are generally covered by a lawful business practice exception, but your employer must have a clear and documented policy.

Trade union rights and algorithmic management

The Trade Union and Labour Relations (Consolidation) Act 1992 (TULRCA) protects your right to be a member of a trade union and to take part in trade union activities. Your employer cannot use AI surveillance to identify union organisers or monitor protected union activity, and cannot dismiss or disadvantage you for union membership or activities.

Where a recognised trade union exists, AI governance is increasingly becoming a subject for collective bargaining. Several UK unions — including GMB, Unite, and Prospect — have developed model AI clauses for collective agreements covering algorithmic management, AI-driven performance monitoring, and transparency rights. If you are in a unionised workplace, your union may have negotiated specific protections.

Employment Rights Act 1996: unfair dismissal and AI

If you have two years' continuous employment, you are protected against unfair dismissal. If an employer uses AI to identify you for disciplinary action or redundancy, they must still follow a fair procedure — investigation, notice, right to be accompanied, appeal. An AI-generated recommendation that triggers dismissal without a genuine procedural process is likely unfair dismissal regardless of whether the AI was "right".

The Employment Tribunal has jurisdiction over unfair dismissal claims. You must file within 3 months less one day of dismissal (subject to early ACAS conciliation). Compensation is uncapped in discrimination cases; for unfair dismissal, the basic award is calculated using age and length of service, with a compensatory award capped at the lower of 52 weeks' gross pay or £118,223 (for dismissals on or after 6 April 2025), rising to £123,543 for dismissals on or after 6 April 2026.

The Employment Rights Act 2025

The Employment Rights Act 2025 received Royal Assent on 18 December 2025 and introduces two landmark changes to unfair dismissal law from 1 January 2027: the qualifying period for ordinary unfair dismissal is reduced from two years to six months, and the statutory cap on the compensatory award is abolished entirely — aligning ordinary unfair dismissal compensation with the uncapped awards available in discrimination and whistleblowing claims. Employers should prepare now: any employee hired from July 2026 onwards will reach six months' service on 1 January 2027 and acquire unfair dismissal protection from that date.

Practical steps if you think your rights have been breached

Raise a formal grievance with your employer in writing — this preserves your position and creates a record. Contact ACAS (acas.org.uk) for free, impartial advice — early conciliation through ACAS is required before most Employment Tribunal claims. Submit a subject access request for your personal data including any AI-generated assessments. Seek employment law advice — many solicitors offer fixed-fee or no-win-no-fee arrangements for discrimination and unfair dismissal claims. Contact the ICO (ico.org.uk) if your concern is about data protection rather than employment law — the ICO can investigate and issue enforcement notices.