01
Scope of application & addressees
- Organisations using personal data for automated approval, scoring, recruitment or risk assessment in the United Kingdom
- Controllers making decisions with legal or similarly significant effects
- Teams designing, procuring or operating automated decision systems
02
Core regulatory mandates & key requirements
01A new statutory structure applies to significant automated decisions and treats special-category data separately.
02Individuals receive information and may make representations, challenge the outcome and request human intervention.
03Organisations should update privacy information, decision workflows, human review and evidence records.
03
Enforcement & compliance timeline
The Act received Royal Assent.
Relevant provisions commence through implementing regulations.