Data Protection: Artificial Intelligence

The Department for Science, Innovation and Technology does not currently use solely automated decisions-making (ADM) with legal or similarly significant effects on individuals. However, should the department decide to use solely ADM in the future, it must comply with the UK’s data protection laws, namely the UK GDPR and the Data Protection Act 2018, (as amended by the Data (Use and Access) Act 2025), and should have regard to guidance from the Information Commissioner’s Office (ICO) as the independent data protection regulator. This includes providing safeguards for individuals such as informing them if significant decisions are taken about them based solely on automated processing, an individual will always be able to challenge such decisions, obtain human intervention, and make representations to the department about the decision.

If personal data is processed using systems that support a decision, but a human contributes meaningfully to the final outcome, the decision is unlikely to be classed as solely automated decision-making. In these cases, the specific safeguards for solely automated decisions would not apply. However, the processing must still comply with wider data protection requirements, including fairness, lawfulness, transparency and accountability.

Where processing is likely to present a high risk to individuals, a Data Protection Impact Assessment (DPIA) will be undertaken to identify and assess those risks and put appropriate mitigations in place. DSIT also operates a data protection complaints procedure, in line with the Data Protection Act 2018, to investigate and respond to any concerns raised by individuals.