Data Protection Act 2018 (c. 12) – Section 97 – Right to intervene in automated decision-making

Sections

Section 97Right to intervene in automated decision-making

(1) This section applies where—

(a)
the controller takes a decision significantly affecting a data subject that is based [^F1on entirely] automated processing of personal data relating to the data subject, and
(b)
the decision is required or authorised by law.

(2) This section does not apply to such a decision if—

(a)
the data subject has given consent to the decision being made on that basis, or
(b)
the decision is a decision taken in the course of steps taken—
- (i)
  for the purpose of considering whether to enter into a contract with the data subject,
- (ii)
  with a view to entering into such a contract, or
- (iii)
  in the course of performing such a contract.

(3) The controller must as soon as reasonably practicable notify the data subject that such a decision has been made.

(4) The data subject may, before the end of the period of 1 month beginning with receipt of the notification, request the controller—

(a)
to reconsider the decision, or
(b)
to take a new decision that is not based [^F2on entirely] automated processing.

(5) If a request is made to the controller under subsection (4), the controller must, before the end of the period of 1 month beginning with receipt of the request—

(a)
consider the request, including any information provided by the data subject that is relevant to it, and
(b)
by notice in writing inform the data subject of the outcome of that consideration.

(6) ^F3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Amended text

This Section is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.

Annotations

Textual Amendments

F1 Words in s. 97(1)(a) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 80(5)(a), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)
F2 Words in s. 97(4)(b) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), ss. 80(5)(b), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)
F3 S. 97(6) omitted (5.2.2026) by virtue of Data (Use and Access) Act 2025 (c. 18), ss. 80(5)(c), 142(1); S.I. 2026/82, reg. 2(j) (with reg. 5)

Commencement Information

I1 S. 97 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(d)

https://dpa2018.digiphile.law/article/article-97.html

Text as at 18 September 2026.

This is an unofficial convenience version of the Data Protection Act 2018. It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.