When an AI agent makes a decision about you: what UK data law says you can do

In a House of Lords written answer dated 19 October 2026, the government said the UK's automated decision-making safeguards apply to AI agents "where relevant". Baroness Twycross wrote that controllers "must ensure the safeguards as outlined in Articles 22C of the UK GDPR are in place where relevant regardless of the type of technology used, including AI agents."

What was asked, and what the answer says

Baroness Alexander of Cleveden asked whether the safeguards introduced by the Data (Use and Access) Act 2025 "apply to personal AI agents that act on a user's behalf". The answer opens: "The UK’s data protection framework is technology neutral".

On our reading, the answer, framed around controllers, does not separately address an agent a person runs for themselves. The law attaches the safeguards to a significant decision "taken by or on behalf of a controller in relation to a data subject", so they protect the person a decision is about.

When the rules apply

Article 22A says a decision is "based solely on automated processing if there is no meaningful human involvement in the taking of the decision", and is significant if "it produces a legal effect for the data subject" or "it has a similarly significant effect". The ICO's draft guidance says all three must be present: a decision about a person, a significant one, and no meaningful human involvement.

• ICO examples of similarly significant effects include "automatic refusal of an online credit application" and "e-recruiting practices without meaningful human involvement".
• Out of scope, usually. The ICO says using a generative AI application to summarise a meeting "is unlikely to lead to a legal, or similarly significant effect, in most cases".

On agents specifically, the ICO's call for evidence says "an agent may make multiple decisions to influence a final outcome. Depending on the circumstances, this could fall within the scope of the ADM provisions". It adds that "human involvement at one stage of a workflow doesn’t necessarily mean that the overall decision falls outside the ADM provisions", but also that an agentic system being involved "doesn’t, by itself, mean that the ADM provisions apply."

The four safeguards

Article 22C(2) says the safeguards "must consist of or include measures" which:

• "provide the data subject with information about decisions" taken about them;
• "enable the data subject to make representations about such decisions";
• "enable the data subject to obtain human intervention on the part of the controller";
• "enable the data subject to contest such decisions."

Article 22B adds limits. A significant, solely automated decision based wholly or partly on special category data (as listed in Article 9(1)) needs the person's explicit consent, or must be necessary for a contract or required or authorised by law with the Article 9(2)(g) substantial public interest condition met. And a significant decision "may not be taken based solely on automated processing" where the processing relies wholly or partly on Article 6(1)(ea), the new basis for "a recognised legitimate interest".

What you can do, according to the ICO's draft guidance

If a decision is in scope, the draft guidance says:

• Get an explanation of your decision. The ICO says this is "decision-specific information about the actual outcome, rather than simply repeating information you provide in your privacy notice".
• Put your side. Making representations includes "the chance to produce any additional information you may have missed."
• Ask for a human. The ICO says human intervention "involves a review of the decision, with the possibility that you could change it."
• Contest it. Organisations "must put measures in place for people to challenge or appeal".
• Expect a reply within a month. Organisations "must act on the person’s request without undue delay and at the latest within one month of receipt", extendable by a further two months for complex or multiple requests.

If that fails, the ICO's complaints page asks for "a copy of the complaint you made to the organisation". It says "The ICO can't award compensation", but adds: "You have a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law." It also says complaints needing more detailed work "are currently being assigned to case officers around 10 months after submission".

What is still pending

• Final guidance. The ICO's ADM guidance pages quoted here are a draft, updated 31 March 2026. The minister says "The final version of the guidance will be published by the end of this year."
• A statutory code. A code of practice on AI and automated decision-making is "due to be published in draft in 2027", according to the answer.
• Evidence on agents. The ICO's call for evidence on agentic AI "will close this November", the answer says; the ICO's consultation page gives a closing date of 20 November 2026. We covered its launch in our 11 October report, in which the ICO says ten AI developers have made or committed to data protection changes.

Why it matters

On our reading, the answer means a decision about you is not outside these rules because an AI agent took it. Whether they apply still turns on the tests in Article 22A: is the decision significant, and was there meaningful human involvement? For agents, the ICO has set out initial expectations in its call for evidence, including that organisations "must assess whether and how the ADM provisions apply across the complete workflow"; it says the evidence will "inform our statutory code of practice on AI and automated decision-making (ADM)".