Automated Decision-Making (ADM)
Decisions made solely by automated means that significantly affect individuals, as per UK GDPR and DPA 2018.
How the laws define this
At their core, both instruments agree that automated decision-making centers on determinations made without significant human participation, whether described as decisions made solely by automated means or processes with no substantial human involvement. The key divergence between them concerns the impact threshold and procedural traits needed to fit the definition. The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 restricts its definition to decisions, including profiling, that produce legal effects concerning an individual or similarly significantly affect them, as defined by the UK GDPR and Data Protection Act 2018. By contrast, the Social Security (Modernisation) Amendment Bill does not incorporate an impact requirement, instead describing a decision within an automated process as being often rules-based and without discretion.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| United Kingdom | Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 | In Force | This definition explicitly includes profiling as part of automated means and specifies producing legal effects or similarly significant effects on individuals. |
| New Zealand | Social Security (Modernisation) Amendment Bill | In Force | This definition limits automated decision-making to decisions within processes lacking substantial human involvement, often rules-based and without discretion. |
What it triggers
- Under the Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026, the UK Information Commissioner's Office must create a statutory code for entities processing personal data in AI.source
- In New Zealand, the Social Security (Modernisation) Amendment Bill expands the use of automated decision-making for routine benefit administration while maintaining human oversight.source
Definitions (2)
Decisions made solely by automated means, including profiling, which produce legal effects concerning an individual or similarly significantly affect them, as defined by the UK GDPR and Data Protection Act 2018.
A decision within an automated process where there is no substantial human involvement in making the decision, often rules-based and without discretion.
Questions and answers
What triggers the need for a statutory code on AI and automated decision-making in the UK?
The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 mandates the UK Information Commissioner's Office to create a statutory code for entities processing personal data in AI.
How does New Zealand define automated decision-making in its welfare system?
It is defined as a decision within an automated process where there is no substantial human involvement, often rules-based and without discretion. The legislation aims for efficiency and consistency in benefit administration while maintaining human oversight.
What is distinctive about the UK definition of automated decision-making compared to New Zealand's?
The UK definition includes profiling and requires legal effects or similarly significant impacts on individuals. New Zealand's focuses on lack of substantial human involvement in rules-based processes.