Legislation – Data Protection Act 2018
Changes to legislation:
Data Protection Act 2018, Section 50 is up to date with all changes known to be in force on or before 08 April 2026. There are changes that may be brought into force at a future date. Changes that have been made appear in the content and are referenced with annotations.
Changes to Legislation
Changes and effects yet to be applied by the editorial team are only applicable when viewing the latest version or prospective version of legislation. They are therefore not accessible when viewing legislation as at a specific point in time. To view the ‘Changes to Legislation’ information for this provision return to the latest version view using the options provided in the ‘What Version’ box above.
PART 3Law enforcement processing
CHAPTER 3Rights of the data subject
Automated individual decision-making
F150Automated decision-making authorised by law: safeguards
(1)
A decision is a “qualifying significant decision” for the purposes of this section if—
(a)
it is a significant decision in relation to a data subject, and
(b)
it is required or authorised by law.
(2)
Where a controller takes a qualifying significant decision in relation to a data subject based solely on automated processing—
(a)
the controller must, as soon as reasonably practicable, notify the data subject in writing that a decision has been taken based solely on automated processing, and
(b)
the data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller to—
(i)
reconsider the decision, or
(ii)
take a new decision that is not based solely on automated processing.
(3)
If a request is made to a controller under subsection (2), the controller must, before the end of the period of 1 month beginning with receipt of the request—
(a)
consider the request, including any information provided by the data subject that is relevant to it,
(b)
comply with the request, and
(c)
by notice in writing inform the data subject of—
(i)
the steps taken to comply with the request, and
(ii)
the outcome of complying with the request.
(4)
The Secretary of State may by regulations make such further provision as the Secretary of State considers appropriate to provide suitable measures to safeguard a data subject’s rights, freedoms and legitimate interests in connection with the taking of qualifying significant decisions based solely on automated processing.
(5)
Regulations under subsection (4)—
(a)
may amend this section, and
(b)
are subject to the affirmative resolution procedure.
(6)
In this section “significant decision” has the meaning given by section 49(2).