Solutions — instrument
The UK stopped asking whether you may. It now asks whether you can show it.
On 5 February 2026 the Data (Use and Access) Act deleted Article 22 of the UK GDPR and replaced it with Articles 22A to 22D. The EU prohibits solely automated significant decisions and allows three exceptions. The UK now permits them, provided you implemented the safeguards. That turns a permission question into an evidence question, asked afterwards, about a decision that already happened.
The reversal
Under EU GDPR Article 22 a data subject has the right not to be subject to a solely automated decision with legal or similarly significant effects. Three narrow exceptions follow. The default is no.
Under UK Article 22C, where no special category data is involved, that decision may be taken, provided the controller has implemented the safeguards the article lists. The default is yes.
A firm that reads the EU map for a UK deployment after 5 February 2026 is being scored against an article its own regulator has repealed. That is the reason this map exists and is not a relabelled copy of the EU one. Three clauses appear in both, because three clauses were genuinely retained.
Everything turns on four words
Article 22A(1)(a) is the hinge of the entire regime:
“a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision”
If the involvement was meaningful, Articles 22B and 22C do not apply at all. If it was not, they apply in full. The compliance posture of an entire agent estate rests on a fact about what a person did at the moment of a decision.
The ICO's draft guidance is blunt about what does not count. A human who designed or built the system is not meaningfully involved, because that happened before any real decision was taken. A reviewer who never overrides the system in practice is not meaningfully involved either. The person must be able to intervene, have enough information to form an independent view, and actually exercise judgement.
That is a record almost no logging stack keeps, because it is not a record of what happened. It is a record of what a named person could have stopped and did not.
Four safeguards, and only some of them are ours
Article 22C lists what must be in place. Fourteen clauses are mapped, eleven of which this platform can produce evidence for.
- 22C(1)(a) — information about the decision
- What ran, under whose authority, against what scope, per decision. The ICO asks for it without overly technical explanation, which is a writing obligation on you rather than a data one.
- 22C(1)(b) — representations
- Yours. A channel for a person to say something to another person. What is supplied is the record it is made against.
- 22C(1)(c) — human intervention
- The review gate, and the closest fit in this map between a statutory safeguard and a mechanism that already exists.
- 22C(1)(d) — contest
- Contesting a decision is only meaningful against a record that cannot have been edited since. Sealed records give a contest something fixed to argue with; running the appeal is yours.
The trap
The same Act introduced recognised legitimate interests at Article 6(1)(ea), a new lawful basis with no EU counterpart and, uniquely, no balancing test. It is the most attractive basis on the list for exactly that reason.
Article 22B(4) then bars it from powering a significant automated decision. A policy can refuse that combination outright once the claimed basis is recorded on the decision, which is the sort of rule that is cheap to enforce and expensive to discover you broke.
What is not scored, and why
- Article 22D — the power to move the definitions
- The Secretary of State may define meaningful human involvement and significant decision by regulations, and may add to the 22C safeguards. A power is not a duty, so it is recorded and not graded. It is on the page because it tells you the shape of your own risk: the two definitions this regime rests on can change without a new Act.
- Whether a decision is significant
- Yours. A legal determination about your business, not something inferable from a tool call. The ICO's draft guidance warns that where a decision is significant for some people and not others, such as freezing an account, the safeguards may have to apply to all of them unless you can separate the populations confidently.
- The ICO's updated guidance
- Still draft. The consultation ran 31 March to 29 May 2026 and the final version is due Winter 2026. Draft guidance is not an obligation, so nothing here is scored against it. Where it is quoted it is marked as the ICO's draft position.
Cut from the Act as commenced by SI 2026/82. This map covers the clauses that bear on agentic decisions and is not the whole of UK GDPR, exactly as the EU map is not the whole of the EU regulation. The DPA 2018 is a separate instrument again and is not mapped. Whether the mapping fits your deployment is a determination for you and your counsel.