Many online lenders decide an application within seconds, with no person looking at it. Where a refusal or the terms offered come from a system alone, the UK GDPR’s provisions on automated decision-making (ADM) can apply. This guide summarises those provisions as the Information Commissioner’s Office (ICO) explains them in its guidance, which the ICO describes as a draft updated on 31 March 2026 to reflect the Data (Use and Access) Act 2025. It applies across the UK to firms processing personal data, and it sits alongside, rather than replaces, the FCA’s affordability rules.
When the ADM provisions apply
According to the ICO, the provisions apply only where three factors are present. A system is making a decision about a person, the decision is a significant one, meaning it has a legal or similarly significant effect, and the decision is solely automated, meaning there is no meaningful human involvement. The guidance treats the automatic refusal of an online credit application as an example of a similarly significant effect. It also says ADM does not need advanced technology: a simple system can fall within scope, and producing a credit score using machine learning is given as an example of processing that may be ADM. By contrast, a human merely applying a fixed rule they set in advance may not count as the system making its own decision.
What counts as meaningful human involvement
If a person genuinely takes part in the decision, the ADM provisions do not apply even where the decision has significant effects. The ICO says human involvement must be active rather than token: the reviewer should assess the decision at an appropriate point so that it can affect the outcome, have discretion and authority to change it, be suitably trained to understand the system’s outputs and limits, and take account of the relevant data. Occasional spot-checking is not enough, and a human only designing the system, or only entering data for it to process, does not amount to meaningful involvement. This matters for borrowers because a lender’s statement that “a person checks every application” is only relevant if that check has real influence on the result.
Information a borrower is entitled to
The guidance identifies three points at which information must be given. Privacy information, at the time data is collected, must cover the existence of ADM including profiling, meaningful information about the logic involved and the significance and expected consequences. A subject access request must provide the same details, including information on ADM already carried out about the requester. When an ADM decision is made, the safeguards apply. The rights to a copy of a credit agreement are separate, but the two can be used together when a decision needs to be understood.
The four safeguards
The ICO quotes the UK GDPR’s requirement that safeguards include measures which provide information about decisions, enable representations about them, enable the person to obtain human intervention and enable the person to contest the decision. The information about a decision is specific to the individual case. For a loan, the guidance suggests that a person might need to know what data was processed, what period it covered, what the system decided and which risk factors it identified. Representations give the applicant a chance to put their view and to supply information the system may have missed, and the lender must make clear that this right exists.
Human intervention and contesting a decision
Human intervention means a person can ask for a human to review the decision case by case, with the possibility of changing it. The ICO says the reviewer must be able to alter the outcome, must have access to the data and original facts the system used, and must consider any extra evidence the person provides. The organisation should keep a record of how the review was done. People must also be given a way to contest the decision, and the lender must explain how at the point it gives the decision. Requests must be acted on without undue delay and at the latest within one month, extendable by up to two further months for complex requests or several requests, with an explanation.
How this fits with lending rules
These provisions are data protection rights and do not, on their own, require a lender to approve an application. Lending decisions must still meet the FCA’s requirements on affordability, explained in the guide to affordability checks and the related guide on Open Banking checks. A borrower who believes a refusal rested on wrong data can also use the routes in the guide to errors on your credit file.
FAQs
Does every automated credit check trigger these rules?
No. According to the ICO, the ADM provisions apply only to decisions that are significant and solely automated, without meaningful human involvement.
Can I ask for a person to look at my application again?
Where the provisions apply, the safeguards include the ability to obtain human intervention, meaning a review by someone able to change the decision.
How long does a lender have to respond?
The ICO says requests under the ADM provisions must be acted on without undue delay and at the latest within one month, with a possible extension of two further months for complex cases.
Is the ICO guidance final?
The ICO describes the guidance as draft, updated on 31 March 2026, so details may change.
The bottom line
Where a lender’s decision is significant and solely automated, the UK GDPR requires safeguards, including information about the decision, the chance to make representations, human review and a way to contest the outcome. Whether a particular refusal is in scope depends on how much genuine human involvement there was, and the ICO guidance on the point remains in draft. Borrowers can start by asking the lender directly. This is general information, not legal advice.