The Information Commissioner’s Office (ICO) has published a consultation on proposed updates to its guidance on automated decision-making (ADM).

The updates are prompted by changes to the law on ADM ushered in by the Data (Use and Access) Act 2025. As we previously discussed here, those changes relax restrictions on ADM, creating what the Government has described as a “more permissive framework under the UK GDPR for organisations to make decisions based solely on automated processing that have legal or similarly significant effects on individuals”.

However, despite this relaxation of the rules, the length of the guidance is an indication that organisations still have to comply with a wide range of requirements when deploying ADM, including ensuring that appropriate safeguards are in place to protect data subjects. Furthermore, there continue to be strict rules on the limited circumstances in which ADM can be carried out using special category data, which are also explored in the guidance.

The updated guidance is particularly helpful in providing clarity on the meaning of key elements of the ADM provisions in the UK GDPR, some of which are not defined in legislation. For example, the ADM provisions only apply when an organisation is:

1. using a system that is making a decision about a person;
2. the decision is a significant decision (meaning it has ‘legal or similarly significant effects’); and
3. the decision is solely automated (meaning there is no meaningful human involvement).

The guidance explains what this means in practice, together with helpful examples. For instance, the ICO proposes that a ‘decision’ should be given an expansive meaning of “a conclusion or outcome reached after consideration or analysis, where that conclusion may either impact or influence actions taken or engage a person’s right”. As for what constitutes a ‘significant decision’, the guidance expands on the definition set out in the UK GDPR, explaining that “a decision that has a similarly significant effect is one that has an equivalent impact on someone’s circumstances, behaviour, opportunities, or choices” and that context is critical in assessing a decision’s significance.

The draft guidance also covers a range of other areas, such as what constitutes “meaningful human involvement” and how safeguards should be applied by organisations deploying ADM.

The consultation on the proposed updates to the guidance closes on 29 May 2026, and can be read in full here.