UK Data (Use and Access) Act 2025: automated decisions and deepfake offence
New UK rules on automated decision-making, in force since 5 February 2026, and a new offence in England and Wales of creating sexual deepfakes of adults, in force since 6 February 2026.
The Act replaced Article 22 of the UK GDPR. Solely automated significant decisions are now generally allowed, but people must be told about them and be able to make representations, get human intervention and contest the decision. Stricter conditions apply where special category data is used.
It also made it a criminal offence in England and Wales to create, or ask someone else to create, a purported intimate image of an adult without consent.
Key dates
Royal Assent
New automated decision-making rules commence
Offence of creating a purported intimate image commences