Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 22B – Restrictions on automated decision-making
Articles
Article 22B[F1Restrictions on automated decision-making
1. A significant decision based entirely or partly on processing described in Article 9(1) (processing of special categories of personal data) may not be taken based solely on automated processing, unless one of the following conditions is met.
2. The first condition is that the decision is based entirely on processing of personal data to which the data subject has given explicit consent.
3. The second condition is that—
- (a)the decision is—
- (i)necessary for entering into, or performing, a contract between the data subject and a controller, or
- (ii)required or authorised by law, and
- (i)
- (b)point (g) of Article 9(2) applies.
4. A significant decision may not be taken based solely on automated processing if the processing of personal data carried out by, or on behalf of, the decision-maker for the purposes of the decision is carried out entirely or partly in reliance on Article 6(1)(ea).]
Amended text
This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations and footnotes
Textual Amendments
- F1 Ch. 3 Section 4A substituted for Art. 22 (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 80(1), 142(1)(2)(h); S.I. 2026/82, reg. 2(j) (with reg. 5)
https://uk-gdpr.digiphile.law/article/article-22B.html
Text as at 17 September 2026.
This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.