Loading…

Statutory Instruments

2026 No. 425

DATA PROTECTION

The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026

Made

16th April 2026

Laid before Parliament

21st April 2026

Coming into force

12th May 2026

The Secretary of State makes these Regulations in exercise of the powers conferred by section 124A(1) and (2) and section 124B(11) of the Data Protection Act 2018(1). In accordance with section 182(2) of that Act, the Secretary of State has consulted the Commissioner and such other persons as the Secretary of State considers appropriate.

Citation, commencement, extent and interpretation

1.—(1) These Regulations may be cited as The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026.

(2) These Regulations come into force 21 days after the day on which they are laid.

(3) These Regulations extend to England and Wales, Scotland and Northern Ireland.

(4) In these Regulations, “ the 2018 Act ” means the Data Protection Act 2018 .

The code of practice

2.—(1) The Commissioner must prepare an appropriate code of practice giving guidance as to good practice in the processing of personal data(2) under the relevant data protection legislation in relation to—

(a)developing and using artificial intelligence, and

(b)automated decision-making.

(2) The code of practice must include guidance as to good practice in the processing of children’s personal data.

(3) In this regulation—

“ automated decision-making ” means—

(a)

decision-making to which Article 22C(1) of the UK GDPR(3) applies, or

(b)

decision-making to which section 50C(1) of the 2018 Act(4) applies.

“ relevant data protection legislation ” means—

(a)

the UK GDPR, and

(b)

the 2018 Act, except Part 4 of that Act.

Modification to panel requirements

3. Section 124B of the 2018 Act applies to the preparation or amendment of the code of practice required under regulation 2 as if after subsection (7) there were inserted—

“(7A) The panel must not consider or report on any aspect of the code relating to national security.”.

Ian Murray

Minister of State

Department for Science, Innovation and Technology

16th April 2026

(1)

2018 c. 12. Sections 124A and 124B were inserted by sections 92(2) and 93, respectively, of the Data (Use and Access) Act 2025 (c. 18). Commissioner is defined in section 3(8) of the Data Protection Act 2018 as the Information Commissioner.

(2)

See section 124A(7) of the Data Protection Act 2018 for the meaning of “good practice in the processing of personal data”.

(3)

Article 22C was inserted by section 80 of the Data (Use and Access) Act 2025. See section 3(10) of the Data Protection Act 2018 for the meaning of “the UK GDPR”.

(4)

Section 50C was inserted by section 80 of the Data (Use and Access) Act 2025.

Status: This is the original version (as it was originally made). This item of legislation is currently only available in its original format.
The Data Protection Act 2018 (Code of Practice on Artificial Intelligence and Automated Decision-Making) Regulations 2026 (2026/425)
Version from: original only

Displaying information

Status of this instrument

in force Provision is in force
in force* In force only for specified purposes (for detail about the purposes see/hover footnote)
not in force Not in force in England (may be in force in other geographies, see footnotes)
italics Defined term
dfn Defined term (alternative style)
gry bckgrd the in-force status of the provision is complex, check the footnotes

Status of changes to instrument text

The list includes made instruments, both those in force and those yet to come into force. Typically, instruments that are not yet in force (hence their changes are not incorporated into the text above) are indicated by description 'not yet' in the changes made column.