Authored By: Vaibhavi Sudhir Ratnaparkhay
SNDT mumbai and Nottingham Trent University
ABSTRACT
The introduction of artificial intelligence in today’s world is one of the most significant technological shifts in making strategic decisions and the way organisations process data by increasing efficiency, automating the decision and improving the accuracy of data analysis.
However with these benefits there comes risk of governance, data privacy handling and the quality of AI generated results. Since AI systems depend on a large volume of personal data, training, mechanisms and deployments, their use creates an obligation for complying with data privacy laws. This research examines the relationship between artificial intelligence and data privacy within the United Kingdom. It analyses how UK General Data Protection Regulation, Data Protection Act 2018, The Data (Use and Access Act) 2025 and the guidance issued by the Information Commissioner’s Office, aligns with and regulates the data processing within AI systems. The paper further analyses the challenges of human oversight, transparency and accountability, automated decision making and AI bias. In the end it analyses the comparison between the UK’s established regime with India’s evolving AI laws.
RESEARCH QUESTION: In comparison to India’s strategy under the Digital Personal Data Protection Act 2023, how well does the Data (Use and Access) Act 2025’s reform of automated decision making protect individual rights while facilitating accelerated AI driven decisions?
INTRODUCTION
In the 21st century artificial intelligence is growing rapidly in different sectors of the world. AI is used in different sectors like government, business, healthcare, academic institutions and law enforcement agencies. These rely on AI to improve efficiency, automate the processes, support complex decision making and to boost productivity. AI systems are capable of analysing high volume data based on machine learning that enables organisations to improve their services.
Data is essential to the development and deployment of AI and other data-intensive technologies. While most firms handle (83%) and analyse data (73%) and some even share or sell data (15%), few companies harness its full potential.[1]
Despite these advantages, AI systems extensively depend on data. Machine learning algorithms require a large amount of data for training models, validations and staying up to date. Most of this information forms a part of personal data which brings AI directly under the compliance of data privacy laws. This raises important legal questions regarding fairness, transparency and lawful processing of personal data.
The United Kingdom has a principle based approach for AI regulation rather than a specific comprehensive statute. The UK GDPR[2] and the Data (Use and Access) Act 2025,[3] establishes legal obligations to process the personal data fairly, lawfully, transparently and securely. These are further supported by the guidance published by the Information Commissioner’s Office which is the UK’s independent supervisory authority for data protection.[4]
This paper argues that there comes a risk and compliance liability for using personal data while AI substantially increases the operational efficiency. Therefore, both technological innovation and compliance to standard data protection regulation standards are necessary for the effective functioning of AI
ARTIFICIAL INTELLIGENCE AND DATA PRIVACY
The UK Government’s 2023 policy paper on ‘A pro-innovation approach to AI regulation’ defined AI, AI systems or AI technologies as ‘products and services that are ‘adaptable’ and ‘autonomous.’ The ‘adaptability’ of AI refers to AI systems, after being trained, often developing the ability to perform new ways of finding patterns and connections in data that are not directly envisioned by their human programmers. The ‘autonomy’ of AI refers to some AI systems that can make decisions without the intent or ongoing control of a human.[5]
Artificial intelligence carries out tasks like pattern recognition, developing reports, and making informed decisions which often requires human intelligence. Machine learning and training AI models increases efficiency through analysing massive datasets.
Organisations handle large amounts of personal data while developing/training AI systems. This includes identified or identifiable natural persons which is considered personal data under Article 4 (1) of UK GDPR. [6] Personal data like healthcare records, name, address, biometric information, financial information and other types of information which is used to identify a person are all included in this definition.
One of the most important concepts of processing is defined under Article 4 (2) of UK GDPR as “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means”. This includes storing, organising, collecting, disclosing, disseminating, restricting or retrieving of the personal data. Almost each and every step in developing AI is considered processing under UK data protection law because AI gathers information for analysing and producing outputs. The relationship between AI and data privacy therefore extends beyond simple data collection.
The ICO cautions organisations that they cannot presume that data gathering is justified by technological developments. Therefore throughout the process of developing AI the developers should adhere to the laws and fundamental principles set by UK GDPR.
UK LEGAL FRAMEWORK
The United Kingdom does not have comprehensive laws on AI but AI systems remain subject to an important legal framework which governs the processing of personal data.
3.1 UK General Data Protection Regulation
This is the primary instrument which regulates AI directly including how organisations process personal data, regardless of it being processed manually or through automated technologies. Everyone responsible for using personal data has to follow strict rules called ‘data protection principles’ unless an exemption applies. [7] The main principle lies within Article 5 which states six fundamental principles governing all processing activities which is lawfulness, fairness, transparency; collected for specified and legitimate purpose; data is adequate, relevant and limited to what is necessary; data is accurate and up to date; kept in a form which permits identification of data subjects and processed in a manner that ensures appropriate security of the personal data. [8]
These principles are especially important for developing AI systems because machine learning often necessitates large amounts of constantly updated data.
Before processing personal data, organisations must establish a legitimate legal basis in accordance with the lawfulness principle. Every processing action must meet one of the established legal principles under Article 6. Therefore, AI developers cannot just process personal information to simply enhance algorithmic efficiency.[9]
Similarly, based on the principle of fairness, the organisations should ensure the data is up to date to avoid biases and unjustified discriminatory outcomes. As a result of this AI systems require ongoing evaluation of the personal data and once again the organisation has to consider all the laws.
Article 32, mandates that controllers and processors introduce organisational and technological safeguards to prevent unauthorised access, unintentional loss, destruction or disclosure of the personal data. Adherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements. [10]
3.2 DATA PROTECTION ACT 2018
This act provides additional provisions regarding the processing of information, provision in connection with the Information Commissioner’s functions, provision for a direct marketing code of practice and certain exemptions applicable in particular circumstances. It gives individuals the right to access their own personal data through subject access requests and contains rules which must be followed when personal data is processed.[11]
3.3 DATA (USE AND ACCESS) ACT 2025
This act implemented changes to the UK’s automated decision making process, stating the government’s goal to amend data protection legislation while promoting responsible technology innovation. It changes data protection laws in order to promote innovation and economic growth and make things easier for organisations, whilst it still protects people and their rights. Most of the changes offer an opportunity to do things differently, rather than needing to make specific changes to comply with the law. [12] While acknowledging the expanding role of AI in today’s world, these amendments continue to place a strong emphasis on protections for people impacted by important automated decisions.
Nearly any legal basis, including the recently enacted “recognised legitimate interest” basis, is now generally allowed for automated decision making based on personal data under the new framework. [13] The law now makes a clear distinction between ordinary automated decisions and sensitive data driven decisions which are still controlled. The rigid and prohibitive controls that in the past applied to all decisions are now reserved specifically for the decisions based wholly or partially on special category data. [14]
The safeguards regime under Articles 22A- 22D replaces the previous explicit prohibition by requiring controllers to notify individuals about the automated decision; offer a human review mechanism upon request; accept and take into consideration individual representations and permit the decision to be contested.[15] These safeguards must be incorporated into the process prior to a decision being made, rather than being included after a complaint is raised, which is a crucial procedural aspect.
The government’s proposed rationale for this change was that the previous regulations were too complicated and unclear for organisations to implement with confidence, which was seen as discouraging beneficial uses of automated decision making that could otherwise increase the productivity and results for individuals. [16] This paper examines the direct, government acknowledged conflict between economic/ operational speed and regulatory caution. Similar to this the ICO’s own guidelines acknowledge that organisations may wish to use automated decision making in order to achieve scale at speed, or reduce costs by employing fewer humans in a decision making process”. [17] This is an exceptionally open recognition from a regulator that speed is a valid and expected driver of AI adoption under the new regulations.
DOES THIS NEW REFORM PROVIDE ENOUGH PROTECTION FOR INDIVIDUAL RIGHTS?
Assessing this based on how Articles 22A – 22D are likely to operate in reality practice. In my opinion, taking into consideration the above, there are three main problems:
4.1 Meaning of “Meaningful”
First the definition of “meaningful” human assessment is debatable and easily misinterpreted in practice. According to ICO guidelines, if a human’s sole function is to provide input data to a system that makes the decision, it does not qualify as a meaningful human involvement and the decision is still “solely automated” and the safeguards framework is still applicable. [18] In order for human review to be really important, it must typically take place after the automatic decision has been made and must interact with the final product rather than just support the procedure that produced it. In theory this is significant protection, but it also poses a serious practical risk that organisations may think they have met the human in the loop requirement through a brief review step that does not meet this bar, especially considering how much discretion is found in organizational culture and individual staff training as opposed to the letter of law.
4.2 Scrutiny by courts and regulators.
While determining whether a decision was truly solely automated, courts and regulators are increasingly examining the entire organisational environment rather than just a system’s technical specifications. While determining if human intervention was genuine, decision makers consider organisational structure, reporting guidelines and staff training, this is based on the comparative studies on GDPR style Automated Decision Making enforcement across jurisdictions. [19] This implies that adherence to the new UK regulation cannot be attained solely through policy documents, rather it depends on how decision making is actually organised on a daily basis within an organisation. This is much more difficult for a regulator to verify, and it is also more difficult for individuals to challenge it without basic knowledge of how a decision was actually made.
4.3 Challenges in implementing DUAA 2025 Automated Decision Making Reforms
The third and the most important point to analyse is of current law that is the regulatory safeguard intended to support the reform is still incomplete. The ICO’s substantive guidance was still under consultation as of mid 2026 and the statutory code itself is not expected until 2027.[20] DUAA expects a statutory code of practice on AI and automated decision making and secondary legislation bringing this requirement into force was made in April 2026. [21] organisations are expected to use the ICO’s pre reform guidelines as a practical baseline till then. [22] This means that the anticipated interpretive safeguard is about a year behind the more permissive legal default which is already fully operative. The lack of established case laws under this new provision has also been recognised in the legal commentary, which reduces assurance for organisations and people hoping to rely on the new ability to challenge a judgement. [23]
COMPARISON BETWEEN UK REGIME AND INDIA’s DIGITAL PERSONAL DATA PROTECTION ACT 2023
India’s strategy provides an insightful comparison because it does not have specific automated decision making regulations. Before the Digital Personal Data Protection Act 2023, the data was governed by the Information Technology Act 2000[24] and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules 2011.[25]
Digital Personal Data Protection Act 2023 imposes significant requirements on organisations which use personal data, this includes those related to obtaining consent, breach notifications and establishment of the Data Protection Board of India. [26] What regulates AI in India are the Ministry of Electronics and Information Technology’s non-binding guidelines, current information technology regulations and the Digital Personal Data Protection Act 2023 principles.
The UK’s laws are significantly different for this. The UK has changed and included the Data (Use and Access) Act 2025 for regulating automated decision making. The comparison shows that two countries stand at different stages of regulatory development. While the UK is working on redefining the already established legal framework taking into consideration individual rights, on the other hand India is still implementing its data protection laws and has yet not introduced any specific laws relating to AI.
Since India has not yet established the laws relating to automated decision making as a separate category of risk, UK’s reform debate on whether substituting a restriction with a right to challenge sufficiently protects individuals is an important issue that India has not yet addressed.
This raises one important point, that is a jurisdiction’s potential to protect their own individuals from AI decisions. This not only depends on how strict laws are but on how their enforcements are regarding the AI driven decisions.
RECOMMENDATIONS
The UK’s approach to automated decision making has been enhanced and regulated by the Data (Use and Access) Act 2025, but still there are a number of steps which should be taken to prevent innovation from compromising individual rights. It should give proper guidelines on how to apply Article 22A-22D consistently and ICO should give statutory code of practice. They should establish precise meaning of “meaningful human involvement” through proper regulatory advice and sector specific examples. In the last, the organisations should keep records of all the automated decision making procedures which shall include proof of human intervention/review.
CONCLUSION
In conclusion the paper analyses whether the Data (Use and Access) Act 2025 bridges the gap between the protection of individuals rights and the benefits of faster AI driven decision making. It states that the Data (Use and Access) Act 2025 replaces Article 22’s restrictive approach with flexible guidelines under Article 22A- 22D. This allows organisations to use AI more effectively while maintaining legal principles like transparency, fairness and ability to challenge the important automated decisions. However, because there is lack of legal guidance, judicial interpretation is restricted and it is quite challenging for ensuring meaningful human oversight. As India’s system is still developing, the UK holds a more advanced legal framework for automated decision making. In the end, the paper concludes that effective governance, proper regulatory guidelines and regular implementation in practice are as important as legislative reform in order to successfully bridge the gap between AI innovation and data privacy.
BIBLIOGRAPHY
TABLE OF LEGISLATION
United Kingdom
Data (Use and Access) Act 2025
UK General Data Protection Regulation (UK GDPR)
India
Digital Personal Data Protection Act 2023
Information Technology Act 2000
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information ) Rules 2011 (GSR 313(E))
Government Publications
Gajjar D, Artificial Intelligence: An Explainer (POSTbrief 57, Parliamentary Office of Science and Technology, UK Parliament, 14 December 2023) https://doi.org/10.58248/PB57 accessed 6 August 2026.
Statutory Instruments (UK)
Data (Use and Access) Act 2025 (Commencement No 1) Regulations 2026 SI 2026/123.
Official Government and Regulatory Sources
Government of the United Kingdom, Data Regulation in the Age of AI and other Data Intensive Technologies (Gov.uk)
Information Commissioner’s Office, Artificial Intelligence (ICO)
Information Commissioner’s Office, Guidance on AI and Data Protection (ICP)
Information Commissioner’s Office, Rights Related to Automated Decision Making including Profiling (ICO)
Information Commissioner’s Office, The Data (Use and Access) Act 2025: What Does it Mean for Organisations? (ICO)
Information Commissioner’s Office, Information Commissioner’s Office (Gov.uk).
Journal Articles
Brian Sanya Mondoh, ‘Data Use and Access Act 2025: Regulating Automated Decision-Making Following UK Data Protection Reforms’ (Lexology, 19 August 2025) <https://www.lexology.com/library/detail.aspx?g=1dcd13a5-baac-4c59-9d9a-c2e337794a1d > accessed on 5th august 2026
Dan Whitehead, Katie McMullan and Michaela Glass, ‘UK’s Data Use and Access Act (2025): Data Protection Provisions Come into Force’ (Hogan Lovells Cadwalader, 6 February 2026) <https://www.hlc.com/en/publications/uks-data-use-and-access-act-2025-data-protection-provisions-come-into-force > accessed on 6th August 2026
Devyani Gajjar, Artificial Intelligence: An Explainer (POSTbrief 57, Parliamentary Office of Science and Technology 2023) <https://researchbriefings.files.parliament.uk/documents/POST-PB-0057/POST-PB-0057.pdf >accessed on 6th August 2026
D’hulst T, Kloza D and Memic A, ‘A New Era for UK Data Protection Law: Reform of the UK GDPR and Proposed Renewal of EU Adequacy’ (UCLouvain and Van Bael & Bellis, 2025) <https://research.dial.uclouvain.be/entities/publication/9e8e9721-7d51-4e39-bacc-0d730f84e39b> accessed on 6th August 2026
Erdos D, ‘UK Data Protection Post- Brexit: The Evolving Landscape” (University of Cambridge Faculty of Law Research Paper No 3/2026, SSRN, 1 April 2026) <https://download.ssrn.com/2026/4/15/6504981.pdf?response-content-disposition=inline&X-Amz-Security> accessed on 6th August 2026
Fetzer JH, ‘What is Artificial Intelligence?’ in Artificial Intelligence: Its Scope and Limits (Springer 1990) 3. <https://link.springer.com/chapter/10.1007/978-94-009-1900-6_1 > Accessed on 5th August 2026
Myles P, Axson E and Mitchell C, ‘Data Quality, Provenance and Transparency in Real-World Data: Aligning Quality Standards with Data Governance Legal Frameworks’ (2026) 8(2) Journal of Data Protection & Privacy 131. <https://www.ingentaconnect.com/content/hsp/jdpp/2026/00000008/00000002/art00002 > Accessed on 6th August 2025
Rob Bratby, ‘Automated Decision-Making After the DUAA: What the New UK Regime Means for AI-Enabled Products’ (Bratby Law, 9 April 2026) <https://bratby.law/automated-decision-making-duaa-uk-regime/ > accessed on 6th August 2026
Sam Honey, ‘The Data (Use and Access) Act 2025: What the UK’s New Data Law Means for Your Business and Your Privacy Compliance Strategy’ (Acuity Law, September 2025) <https://acuitylaw.com/data-use-and-access-act-2025/ > accessed on 5th August 2026
Sebastião Barros Vale and Gabriela Zanfir-Fortuna, Automated Decision-Making under the GDPR: Practical Cases from Courts and Data Protection Authorities (Future of Privacy Forum 2022) <https://fpf.org/wp-content/uploads/2022/05/FPF-ADM-Report-R2-singles.pdf > accessed on 4th August 2026
Taylor L, de Souza SP, López Solano J and others, ‘Governing Artificial Intelligence Means Governing Data: (Re)Setting the Agenda for Data Justice’ (2025) 2(1) Dialogues on Digital Society <https://journals.sagepub.com/doi/full/10.1177/29768640241306800> Accessed on 5th August 2026
University of Bath, ‘Data Protection Act’ (University of Bath, last updated 7 March 2024) <https://www.bath.ac.uk/legal-information/data-protection-act/ > accessed on 6th August 2026
Van Bael, Bellis, ‘A New Era for UK Data Protection Law: Reform of the UK GDPR and Proposed renewal of EU Adequacy’ 28th August 2025, <file:///Users/vaibhaviratnaparkhay/Downloads/20250828_A_New_Era_for_UK_Data_Protection_Law.pdf> accessed on 5th August 2026
Websites
Bird & Bird, ‘ICO Launches Consultation on Draft Guidance on Automated Decision-Making and Profiling’ (Bird & Bird, 2026) <https://www.twobirds.com/en/insights/2026/ico-launches-consultation-on-draft-guidance-on-automated-decision-making-and-profiling> accessed on 5th August 2026
Department for Science, Innovation and Technology, Data Regulation in the Age of AI and Other Data-Intensive Technologies (Call for Evidence, 15 July 2026) <https://www.gov.uk/government/calls-for-evidence/data-regulation-in-the-age-of-ai-and-other-data-intensive-technologies/data-regulation-in-the-age-of-ai-and-other-data-intensive-technologies> accessed 5th August 2026
Government Digital Service, ‘Data Protection: The UK’s Data Protection Legislation’ (GOV.UK, last updated 22 January 2025) <https://www.gov.uk/data-protection > accessed on 5th August 2026
[1]. Department for Science, Innovation and Technology, Data Regulation in the Age of AI and Other Data-Intensive Technologies (Call for Evidence, 15 July 2026) <https://www.gov.uk/government/calls-for-evidence/data-regulation-in-the-age-of-ai-and-other-data-intensive-technologies/data-regulation-in-the-age-of-ai-and-other-data-intensive-technologies> accessed 5th August 2026
[2] Retained Regulation (EU) 2016/679 (UK GDPR)
[3] Data (Use and Access) Act 2025
[4] Information Commissioner’s Office, ‘Information Commissioner’s Office’ (GOV.UK) <https://www.gov.uk/government/organisations/information-commissioner-s-office > accessed 6th August 2026
[5] Devyani Gajjar, Artificial Intelligence: An Explainer (POSTbrief 57, Parliamentary Office of Science and Technology 2023) <https://researchbriefings.files.parliament.uk/documents/POST-PB-0057/POST-PB-0057.pdf >accessed on 6th August 2026
[6] UK GDPR, art 4(1)
[7] Government Digital Service, ‘Data Protection: The UK’s Data Protection Legislation’ (GOV.UK, last updated 22 January 2025) <https://www.gov.uk/data-protection > accessed on 5th August 2026
[8] UK GDPR, art 5
[9] UK GDPR, art 6
[10] UK GDPR, art 32
[11] University of Bath, ‘Data Protection Act’ (University of Bath, last updated 7 March 2024) <https://www.bath.ac.uk/legal-information/data-protection-act/ > accessed on 6th August 2026
[12] Information Commissioner’s Office, ‘The Data Use and Access Act 2025 (DUAA) — What Does It Mean for Organisations?’ (ICO, last updated 19 June 2026) <https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/> accessed on 6th August 2026
[13] Bird & Bird, ‘ICO Launches Consultation on Draft Guidance on Automated Decision-Making and Profiling’ (Bird & Bird, 2026) <https://www.twobirds.com/en/insights/2026/ico-launches-consultation-on-draft-guidance-on-automated-decision-making-and-profiling> accessed on 5th August 2026
[14] Sam Honey, ‘The Data (Use and Access) Act 2025: What the UK’s New Data Law Means for Your Business and Your Privacy Compliance Strategy’ (Acuity Law, September 2025) <https://acuitylaw.com/data-use-and-access-act-2025/ > accessed on 5th August 2026
[15] Dan Whitehead, Katie McMullan and Michaela Glass, ‘UK’s Data Use and Access Act (2025): Data Protection Provisions Come into Force’ (Hogan Lovells Cadwalader, 6 February 2026) <https://www.hlc.com/en/publications/uks-data-use-and-access-act-2025-data-protection-provisions-come-into-force > accessed on 6th August 2026
[16] Dan Whitehead, Katie McMullan and Michaela Glass, ‘UK’s Data Use and Access Act (2025): Data Protection Provisions Come into Force’ (Hogan Lovells Cadwalader, 6 February 2026) <https://www.hlc.com/en/publications/uks-data-use-and-access-act-2025-data-protection-provisions-come-into-force > accessed on 5th August 2026
[17] Information Commissioner’s Office, ‘Rights Related to Automated Decision Making Including Profiling’ (ICO, last updated 31 March 2026) <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/ > accessed on 5th August 2026
[18] Information Commissioner’s Office, ‘Rights Related to Automated Decision Making Including Profiling’ (ICO, last updated 31 March 2026) <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/rights-related-to-automated-decision-making-including-profiling/ >accessed on 6th August 2026
[19] Sebastião Barros Vale and Gabriela Zanfir-Fortuna, Automated Decision-Making under the GDPR: Practical Cases from Courts and Data Protection Authorities (Future of Privacy Forum 2022) <https://fpf.org/wp-content/uploads/2022/05/FPF-ADM-Report-R2-singles.pdf > accessed on 4th August 2026
[20] Bird & Bird, ‘ICO launches consultation on draft guidance on automated decision-making and profiling’ (5 May 2026) <https://www.twobirds.com/en/insights/2026/ico-launches-consultation-on-draft-guidance-on-automated-decision-making-and-profiling > accessed on 5th August 2026
[21]Data (Use and Access) Act 2025 (Commencement No 1) Regulations 2026 SI 2026/123. <https://statutoryinstruments.parliament.uk/instrument/iAH2E8x5 >accessed on 6th August 2026
[22] Rob Bratby, ‘Automated Decision-Making After the DUAA: What the New UK Regime Means for AI-Enabled Products’ (Bratby Law, 9 April 2026) <https://bratby.law/automated-decision-making-duaa-uk-regime/ > accessed on 6th August 2026
[23] Brian Sanya Mondoh, ‘Data Use and Access Act 2025: Regulating Automated Decision-Making Following UK Data Protection Reforms’ (Lexology, 19 August 2025) <https://www.lexology.com/library/detail.aspx?g=1dcd13a5-baac-4c59-9d9a-c2e337794a1d > accessed on 5th august 2026
[24]Information Technology Act 2000 (India)
[25] The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, GSR 313(E), 11 April 2011 (India)
[26] Digital Personal Data Protection Act 2023 (India), ch 5
