---
title: "United Kingdom — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-kingdom/algorithmic-biometric-and-surveillance-governance/
source_html: /jurisdictions/united-kingdom/algorithmic-biometric-and-surveillance-governance/index.html
description: "United Kingdom — Algorithmic, Biometric & Surveillance Governance (Amber, 6 sub-modules, 7 claims): Substantial regulatory activity and guidance exist, but the AI/ADM statutory code of practice is still being developed and national-security"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 771354a8c7b40ada443e170d117e621539210c0db8b4716666864321727aeeeb
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Algorithmic, Biometric & Surveillance Governance | Data Protection Monitor

### D8Algorithmic, Biometric & Surveillance Governance6 sub-modules7 claimsAmber▾#

Substantial regulatory activity and guidance exist, but the AI/ADM statutory code of practice is still being developed and national-security exemption scope remains a monitored risk per EDPB.

Primary framework UK GDPR Articles 22A-22D (as inserted by DUAA 2025); UK GDPR Article 9 (biometric special category data)

Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/)

Traffic-light rationale — Amber Substantial regulatory activity and guidance exist, but the AI/ADM statutory code of practice is still being developed and national-security exemption scope remains a monitored risk per EDPB.

#### Sub-modules (6)

Category narrative 78 words

The DUAA introduces new UK GDPR Articles 22A-22D governing solely-automated significant decisions, relaxing some prior restrictions while retaining a right to human intervention for significant decisions using sensitive or non-sensitive data. Biometric data is treated as special category data requiring an Article 9 condition (typically explicit consent), and the ICO is actively auditing police facial recognition technology (FRT) deployments and developing an AI/ADM code of practice. EDPB has flagged UK national-security exemptions as an area requiring ongoing monitoring.

Evidence 7

Sources and claims (7)
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/) — UK GDPR Article 22A, inserted by the DUAA, defines automated decision-making (ADM) as a decision based solely on automated processing (no meaningful human involvement) that has a legal or similarly significant effect on a person.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/03/automated-decisions-can-streamline-the-hiring-process-with-the-right-safeguards-in-place/) — Organisations using ADM must explain to affected candidates/individuals how it works and how to exercise their right to challenge a decision and request human review.observed 2026-07-28
- Probable[Information Commissioner's Office](https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/) — The ICO is developing draft ADM and profiling guidance for public consultation, which will inform a forthcoming statutory AI and ADM code of practice.observed 2026-07-28
- Probable[Information Commissioner's Office](https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/) — The UK government is developing secondary legislation, committed to during passage of the DUAA 2025, requiring the ICO to produce an AI and ADM statutory code of practice.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/our-information/our-strategies-and-plans/artificial-intelligence-and-biometrics-strategy/ai-and-biometrics-strategy-update-march-2026/) — The ICO has conducted or is conducting facial recognition technology (FRT) audits of multiple UK police forces including South Wales, Gwent, Essex, Leicestershire, West Yorkshire and Greater Manchester Police.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/biometric-recognition/) — Processing biometric data through a biometric recognition system meets all three elements of the UK GDPR biometric data definition, constituting special category biometric data requiring explicit consent or another valid Article 9 condition.observed 2026-07-28
- Probable[European Data Protection Board](https://www.edpb.europa.eu/news/news/2025/draft-uk-adequacy-decisions-edpb-adopts-opinions_en) — The EDPB has flagged that UK national security exemptions may waive most data protection principles and some international transfer rules for law enforcement authorities and can limit the ICO's enforcement and inspection powers, calling for ongoing Commission monitoring.observed 2026-07-28