The UK Replaced Article 22: What to Ask For Now

Why the Article 22 Advice You Found Is Out of Date

The UK stopped having an Article 22, which is why advice quoting it can be confident and still wrong. The Data (Use and Access) Act 2025 substituted a new Section 4A, Articles 22A to 22D, for the old article: in force for specified purposes from 19 June 2025 and otherwise from 5 February 2026 ¹. Anything written before that describes a provision a UK application no longer sits under.

The change is larger than a renumbering.

The blanket right not to be subject to a solely automated decision with significant effects now survives only where special-category data is involved, under Article 22B ¹. For every other UK application the protection is the Article 22C safeguards, and those have to be asked for.

Article 22A(1)(a) defines a solely automated decision as one with no meaningful human involvement ¹. Article 22D lets the Secretary of State set out by regulation what meaningful human involvement means, and what counts as a similarly significant effect ¹. So the boundary can move without another Act of Parliament.

The first thing to fix is the article number you quote.

What Article 22C Entitles You to Ask For

Four safeguards, named in the text rather than left to the employer's discretion. Article 22C says the measures must consist of or include information about the decision taken in relation to you, and the ability to make representations about it ¹. They must also let you obtain human intervention on the part of the controller, and contest the decision ¹. Asking for all four by name turns a vague request into an answerable one.

The safeguards attach to a decision that was already solely automated. They do not entitle anyone to be assessed by a person in the first place, and the safeguard text says only that the human intervention is on the part of the controller ¹.

Ask for all four in one message.

An employer replying that a person reviewed your application has given you something to work with. Ask what that reviewer actually saw, and whether they could have reached a different result. Whether the decision counts as solely automated turns on whether that involvement was meaningful, which Article 22D leaves the Secretary of State to define by regulation ¹.

Writing a request for a second look, including where no law gives you one, is worked through in How to ask for a human review after an automated rejection.

What the ICO Told UK Recruiters They Must Tell You

Three things about the automation, and the ICO put the duty on the recruiter rather than the vendor. Its November 2024 report on AI tools in recruitment says recruiters must inform candidates how their personal information will be processed by AI, by providing detailed privacy information or ensuring the AI provider does ².

That information should explain what personal information the AI processes and how, the logic involved in making predictions or producing outputs, and how personal information is used to train, test or develop the AI ².

The report also tells providers and recruiters to define in their contracts which party owes candidates that information, because the audits found the responsibility was often unclear ².

These are recommendations from consensual audits, not a court ruling and not new legislation. The underlying duty is the transparency principle in UK data protection law. You cannot enforce a recommendation yourself, though you can point to it in a complaint to the ICO ².

Between August 2023 and May 2024 the ICO audited developers and providers of AI sourcing, screening and selection tools, making 296 recommendations and 42 advisory notes, of which 97% were accepted with actions set ³.

Some of those tools gave recruiters a search function that could filter out candidates with certain protected characteristics. Others estimated or inferred gender, ethnicity and other characteristics from an application, or from a name alone. The ICO said inferred information of that kind is not accurate enough to monitor bias effectively, and that it was often processed without a lawful basis and without the candidate's knowledge ³. Neither finding is a discrimination ruling. Both are data-protection findings.

The audits were consensual and the vendors chose to take part, so this is a snapshot of who volunteered rather than a survey of the market. It looked at providers, not at employers. The report gives no counts behind 'some' and 'others'. An accepted recommendation records a commitment, not a verified repair.

The employer-side page here, what an AI notice must say and when each jurisdiction wants it, is written for the recruiter who owes the disclosure rather than the person waiting for it. It covers New York City, Illinois and California, not the UK, so it shows what employers in those places have been told to do.

Which Rules Apply If You Applied to an EU Employer?

EU GDPR Article 22 was not changed, so an application to an EU employer sits under the text the UK replaced. Where that employer makes a solely automated decision on the contract or explicit-consent grounds, Article 22(3) requires at least three safeguards ⁴. They are human intervention on the part of the controller, the chance to express your point of view, and the ability to contest the decision ⁴.

Those safeguards reach only decisions based solely on automated processing with legal or similarly significant effects, and only in the contract and explicit-consent cases ⁴. Article 22(3) is not a right to an explanation of the logic, which sits in a different article of the regulation.

Which text you quote depends on which application you are asking about.

The extra rights you get applying to a European employer works through the EU side, including the parts the UK change left alone.

The two texts no longer say the same thing.

Write the Request So It Names One Decision

Name the role, the date you applied, the stage the rejection came at, and the tool if the employer published which one it uses. Article 22C safeguards attach to a decision taken in relation to you, so a request naming one decision is harder to answer with a link to a policy page ¹. One written message to the contact in the privacy notice is enough to start.

• the role, the reference number if there is one, and the date you applied
• the stage and the date of the decision you are asking about
• the name of the assessment or tool, if the employer published it
• the four Article 22C safeguards, asked for by name
• a plain question: was this decision solely automated

A request an employer can answer in a paragraph is easier to answer than one asking for everything held about you. Keep the copy you sent and the date you sent it, because everything after this rests on what you can show you asked for.

If the reply says a person made the decision, that is an answer rather than a dodge. What that person saw, and whether they could have changed the result, is the follow-up worth putting in writing.

An employer who has never been asked this may take a while, and a second message quoting the same four safeguards is a reasonable next step.

None of that needs a solicitor.

Read the evidence >