Data Protection Act 2018

The Data Protection Act 2018 establishes the United Kingdom’s statutory framework for the processing of personal data and supplements the UK GDPR across general, law-enforcement and intelligence-service contexts. Although the Act contains no references to artificial intelligence, its provisions govern AI systems whenever they involve the automated processing of personal data. Section 14 sets out safeguards for solely automated decision-making, requiring controllers to put in place measures that “provide the data subject with information”, “enable the data subject to make representations”, “enable the data subject to obtain human intervention”, and “enable the data subject to contest” such decisions (s.14(2)(a)–(d)). These statutory duties shape the development and deployment of AI-enabled systems that generate significant decisions about individuals. Liability for non-compliance arises through general data-protection mechanisms, including ICO enforcement and civil claims under the UK GDPR, rather than any AI-specific regime.