Challenge a decision an automated system made about you

This advice applies to England, Scotland, Wales and Northern Ireland.

The short version

• If an automated system made a significant decision about you with no human involvement, you have the right to ask for a human to review it and to contest it.
• Tell the organisation the decision was automated and ask for a human review.
• Make a subject access request to find out what data they used and how the decision was made.
• If the organisation doesn't put things right, complain to the Information Commissioner's Office (ICO).

Check if this applies to you

This guide is for you if all of the following are true:

• An organisation made a decision about you using an automated system.
• No person was meaningfully involved in making that decision.
• The decision significantly affects you - for example, a loan or credit application refused, an online account suspended or banned, a job application filtered out, or an insurance quote declined.

If a person was meaningfully involved in the decision, these specific automated-decision rights don't apply. But you can still make a subject access request and complain to the organisation.

What counts as a significant decision

A significant decision is one that has a legal effect on you or a similarly serious impact. Examples include:

• losing access to an account you depend on
• being refused credit or a loan
• being screened out of a job application
• being refused insurance or quoted a much higher price

If the decision uses sensitive data about you, like your health or ethnicity, you have extra protection. An automated system generally can't make a significant decision using that data on its own.

Your rights

Since 5 February 2026, the Data (Use and Access) Act 2025 updated the rules on automated decisions. Where a significant decision is made about you solely by an automated system, the organisation must:

• tell you about the decision
• let you put your side of the case
• let you get a human to review it
• let you contest it

The human review has to be meaningful. It must be a real person genuinely considering your case, not a rubber stamp.

Ask for a human review

Getting a decision overturned can feel daunting, but you have a clear right to ask. Contact the organisation and tell them:

• the decision was made by an automated system
• you want a person to review it
• you want to contest the outcome

You can make this request verbally or in writing. It's worth following up any verbal request in writing. This gives you a clear record if you need to take things further.

The ICO has guidance on your rights relating to automated decisions, including what organisations must do when you ask for a review.

Make a subject access request

A subject access request (SAR) lets you get a copy of the personal data an organisation holds about you. It can also help you find out how the automated decision was made.

To make a SAR:

• Contact the organisation and ask for a copy of your personal data. You don't need to use any special wording.
• You can make the request verbally or in writing.
• It's free.
• The organisation must reply within 1 month.

See our guide on what data a company holds about you for step-by-step help making a SAR.

Complain if the organisation doesn't help

If the organisation ignores your request or you're not happy with its response, complain to it first. Use its official complaints process - check its website or privacy policy for details.

If the organisation still doesn't put things right, you can complain to the ICO. The ICO can investigate and take action against organisations that break data protection law.

Find out how to make a data protection complaint to the ICO.

What you can do

• Contact the organisation and ask for a human to review the automated decision.
• Make a subject access request to find out what data was used. See our guide on what data a company holds about you.
• If the organisation doesn't respond or won't help, complain to the ICO. Read the ICO's guidance on making a data protection complaint.
• Read the ICO's full guidance on your rights relating to automated decisions.