UK Data Protection – what’s new?

Having come into force on 19 June 2025, it comes as no surprise that we are now seeing the effects of the Data (Use and Access) Act 2025 (‘DUAA’). This article highlights a few of DUAA’s fundamental reforms, delves into one in particular, and examines how this will impact the recruitment sphere.

The next phase of DUAA

From 5 February 2026, the further reforms bought by DUAA will have come into effect. This will mean most provisions bought by DUAA will now be in force, apart from the provisions which requires organisations to have a complaints procedure in place – this will commence on 19 June 2026.

Some of the key changes commencing on 5 February 2026 are:

• A new legal basis for processing data – recognised legitimate interests
• Children’s higher protection matters
• Amendments to the rules regarding data subject access requests
• Expanding the scope for automated decision-making (see more below)

Automated Decision-Making (‘ADM’) – jobseekers beware?

What is ADM?

ADM refers to the process of coming to a decision by automated means and without any human involvement. So, in recruitment terms, this means that algorithms could decide what happens to submitted CVs and job applications.

DUAA relaxes the rules on ADM and allows its use in more circumstances, save where this involves the processing of special category data which remains subject to tighter restrictions.  As DUAA introduces fundamental changes to the use of ADM, it is likely that employers will continue to look for ways on how to utilise AI and ADM throughout the recruitment process. In practice, ADM can look like:

1. Submitting answers to questions posed by chatbots throughout the application process.
2. Having your application assessed by ADM tools and systems.
3. Having your application progressed or rejected based on the assessment by ADM.

Of course, when employers are faced with numerous job applications, the use of enhanced technology systems can make decisions more consistent as well as making the overall recruitment process more efficient. Yet, it is still worth knowing the rights of applicants where ADM is concerned. Firstly, it goes without saying that rigorous practices and policies must still be in place to protect the data rights of all applicants. Secondly, applicants will also have the right to:

1. A fair outcome. If ADM is utilised throughout a recruitment process, organisations should do regular tests on their AI and ADM systems to ensure that decisions are reached fairly, and not as a result of any bias.
2. Know if ADM is utilised. Organisations must let applicants know if ADM is utilised, and how this may impact a decision.
3. Challenge the decision and seek human review. Applicants can challenge decisions made by ADM, explaining their reasoning and ask for a human to take another look.

For more information, see: Automated decisions can streamline the hiring process – with the right safeguards in place | ICO

Regulations for ICO Code of Practice on AI and ADM laid before Parliament

On 21 April 2026, the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (SI 2026/425) were put before Parliament and is set to come into force on 12 May 2026.

Such Regulations would require the Information Commissioner (IC) to publish a code of practice in relation to the developing and using of AI and ADM systems. This code of practice must include guidance on the processing of children’s personal data. The new code of practice will draw on the results and findings from various consultations.

If you require any assistance on ADM, or data protection more generally, please contact a member of our data protection team who will be more than happy to help.