Data Protection Monitor
Global Privacy & Data Protection Intelligence

United Kingdom (UK) · Module Detail

United Kingdom: Algorithmic, Biometric & Surveillance Governance

← Full United Kingdom overview Build report with United Kingdom Request deeper dive

#

Substantial regulatory activity and guidance exist, but the AI/ADM statutory code of practice is still being developed and national-security exemption scope remains a monitored risk per EDPB.

Primary frameworkUK GDPR Articles 22A-22D (as inserted by DUAA 2025); UK GDPR Article 9 (biometric special category data)
Supervisory authorityInformation Commissioner's Office (ICO)
Traffic-light rationale — AmberSubstantial regulatory activity and guidance exist, but the AI/ADM statutory code of practice is still being developed and national-security exemption scope remains a monitored risk per EDPB.

Sub-modules (6)

Category narrative78 words

The DUAA introduces new UK GDPR Articles 22A-22D governing solely-automated significant decisions, relaxing some prior restrictions while retaining a right to human intervention for significant decisions using sensitive or non-sensitive data. Biometric data is treated as special category data requiring an Article 9 condition (typically explicit consent), and the ICO is actively auditing police facial recognition technology (FRT) deployments and developing an AI/ADM code of practice. EDPB has flagged UK national-security exemptions as an area requiring ongoing monitoring.

Sources and claims (7)
  1. ConfirmedInformation Commissioner's Office — UK GDPR Article 22A, inserted by the DUAA, defines automated decision-making (ADM) as a decision based solely on automated processing (no meaningful human involvement) that has a legal or similarly significant effect on a person.observed
  2. ConfirmedInformation Commissioner's Office — Organisations using ADM must explain to affected candidates/individuals how it works and how to exercise their right to challenge a decision and request human review.observed
  3. ProbableInformation Commissioner's Office — The ICO is developing draft ADM and profiling guidance for public consultation, which will inform a forthcoming statutory AI and ADM code of practice.observed
  4. ProbableInformation Commissioner's Office — The UK government is developing secondary legislation, committed to during passage of the DUAA 2025, requiring the ICO to produce an AI and ADM statutory code of practice.observed
  5. ConfirmedInformation Commissioner's Office — The ICO has conducted or is conducting facial recognition technology (FRT) audits of multiple UK police forces including South Wales, Gwent, Essex, Leicestershire, West Yorkshire and Greater Manchester Police.observed
  6. ConfirmedInformation Commissioner's Office — Processing biometric data through a biometric recognition system meets all three elements of the UK GDPR biometric data definition, constituting special category biometric data requiring explicit consent or another valid Article 9 condition.observed
  7. ProbableEuropean Data Protection Board — The EDPB has flagged that UK national security exemptions may waive most data protection principles and some international transfer rules for law enforcement authorities and can limit the ICO's enforcement and inspection powers, calling for ongoing Commission monitoring.observed