Personal data in models

Does a model contain personal data?

Data protection law applies to personal data, which Article 4(1) of the EU’s General Data Protection Regulation, the GDPR, defines as any information relating to an identified or identifiable natural person, the law’s term for a human being. Recital 26 of the GDPR adds that anonymous information, which does not relate to an identified or identifiable person, is outside the GDPR. To decide whether a person is identifiable, recital 26 takes account of “all the means reasonably likely to be used” to identify them, by the controller or by another person, the controller being the organisation that decides why and how the data are used.

A model is a large file of numbers called weights, which training adjusts a little for each passage of training text, as What a model is, an Intermediate module, explains. The models behind chatbots are large language models, trained on vast amounts of text to predict the next word, and the training text is not kept inside them as a list of documents. Models can nonetheless reproduce passages they saw in training, a behaviour called memorisation and covered in Sampling, hallucination and memorisation, an Intermediate module. Researchers showed in a 2021 study that GPT-2, an early OpenAI model, could be made to repeat hundreds of passages from its training data word for word, among them names, telephone numbers and email addresses, some of which had appeared in only one document.

Whether a trained model holds personal data decides whether the GDPR governs the model itself, so that keeping the file, copying it, selling it and running it are all processing of personal data. The same answer decides whether the rights the GDPR gives people, such as the rights to have data about them corrected or erased, extend into the model or stop at the data it was trained on and the answers it gives.

The Hamburg Commissioner for Data Protection and Freedom of Information, one of Germany’s regional data protection authorities, took the view in a discussion paper of July 2024 that merely storing a large language model is not processing of personal data, because in its view such a model does not store personal data. Text is cut into tokens, short fragments of words, before a model sees it, and the Hamburg paper reasoned that a name such as the invented “Mia Müller” survives only as fragments like “Mü” and “ller” and the statistical links between them, numbers recording how likely one fragment is to follow another. In the Hamburg authority’s view, fragments and links of that sort do not relate to any individual.

According to the Hamburg paper, the attacks that researchers use to draw training data out of a model may take effort that the Court of Justice’s case law on identifiability treats as disproportionate, and may use means that German law prohibits. The Hamburg authority therefore doubted that such attacks show that a model holds personal data, while accepting that people could still exercise their rights of access, correction and erasure against the inputs and outputs of the AI system built around the model, such as a chatbot. In a note of May 2025 on Meta’s plan to train its AI models on the public posts of adult Facebook and Instagram users, the same authority wrote that training data are “irrevocably incorporated” into AI models and that, given the current state of technology, their influence is impossible to remove from a model. The note does not refer to the 2024 paper or say whether a model holds personal data.

The European Data Protection Board, the EU body that brings together the national data protection authorities, which the GDPR calls supervisory authorities, took a different view in Opinion 28/2024. The Board adopted the opinion on 17 December 2024 at the request of the Irish Data Protection Commission, and described it as a framework of which supervisory authorities “should take utmost account” when they investigate particular models.

Information from the training data, personal data included, may in the Board’s view remain “absorbed” in a model’s parameters, the numbers, weights among them, that training sets. On the Board’s reading, therefore, a model trained on personal data is not necessarily anonymous, and whether a given model is anonymous should be assessed case by case. Some models are built to give out information about people in their training data, such as a model fine-tuned, meaning trained further, on one person’s voice recordings to imitate that voice, and the Board considers that models of that sort are not anonymous.

For any other model, the Opinion sets a test: the model counts as anonymous only where the likelihood of extracting personal data about people in the training data directly from the model, and the likelihood of obtaining such data by putting queries to it, are both insignificant for every person concerned. Direct extraction, in the Opinion, includes deducing personal data from the model itself with little use of the interface through which users ask it questions, or without using that interface at all, since someone holding a copy of the weight file can, for instance, calculate how likely the model finds a given passage of text. An unusually high likelihood for a sentence giving someone’s address, say, may suggest that the sentence was in the training data. Queries, also called prompts, are the questions and instructions a user types, as every user of a chatbot does.

Both likelihoods are judged by the means reasonably likely to be used by the controller or another person. A supervisory authority may therefore come to a different conclusion about a model published for download by the public than about one that only a firm’s own staff can use.

To test a developer’s claim that its model is anonymous, the Opinion asks supervisory authorities to look at how the model was designed, such as which sources of data were chosen and whether personal data were filtered out or replaced. Supervisory authorities are also to ask whether training used privacy-preserving techniques such as differential privacy, which limits how far any one person’s data can shape the finished model.

Testing against attacks forms part of the same assessment, and the attacks the Opinion lists include membership inference, a test of whether a given person’s record was in the training data. The list also includes regurgitation, where a model repeats its training data, and model inversion, which works back from a model’s outputs towards the data behind them.

Documentation counts heavily in that assessment, since the Opinion states that a supervisory authority unable to confirm, after reviewing the developer’s documentation, that effective measures were taken to anonymise a model could find that the developer has failed in its duty under Article 5(2) of the GDPR to be able to demonstrate compliance.

The Board has since adopted guidelines on anonymisation on 7 July 2026, for a public consultation that closed on 30 October 2026. Final versions had not been adopted on that day, so their wording may still change. Drawing on the Court of Justice’s judgment of 4 September 2025 in EDPS v SRB, the guidelines take the view that information may be anonymous for an organisation unable to identify the person and personal data for another organisation that can.

The guidelines test anonymity against three criteria: the data should not allow the records about one person to be isolated, should not allow those records to be linked with other data, and should not allow specific and meaningful inferences about a person. Data that meet all three criteria may be treated as anonymous, and a failure of either of the first two calls for further analysis. Models come in through the third, since prompting a model with extra information about a person to draw out new information about that person is, on the guidelines’ account, a form of inference. Data that allow a specific and meaningful inference about a person should not, according to the guidelines’ table of outcomes, be considered anonymous from the perspective of at least one organisation able to draw it.

The UK GDPR, the version of the GDPR kept in UK law after Brexit, is enforced by the Information Commission, which took over from the Information Commissioner on 30 September 2026; its office, first the Information Commissioner’s Office and now the Information Commission’s Office, is known in both forms as the ICO. The ICO consulted in 2024 on generative AI, meaning AI that writes text or makes images or sound, and in its response to that consultation, published on 12 December 2024, listed among misconceptions the argument of some developers that their models do not store personal data. That response recalled the ICO’s guidance of 2020 that AI models can contain personal data, and said that generative AI models may embed their training data in a form that may allow its retrieval or disclosure, a risk that needs further research. In a report of 8 October 2026 on its supervision of foundation models, the large general-purpose models on which many AI products are built, the ICO stated its position that a model trained on personal data can still contain personal data. The ICO added that whether a given model does so needs a case-by-case assessment, and that it had started reviewing its 2020 position.

A party arguing that a model holds personal data may also point to the Munich Regional Court’s judgment in GEMA v OpenAI, which held on 11 November 2025 that song lyrics memorised by two of OpenAI’s models were reproduced in the models themselves, in a judgment the court’s press release describes as not final. That judgment decided a copyright claim, and whether its reasoning applies in the same way to personal data is an open question.

In November 2025 the European Commission proposed to change the legal definition itself, in a package of amendments to EU digital law called the Digital Omnibus. The proposal would add to Article 4(1) of the GDPR that information is not personal data for an organisation unable to identify the person by means reasonably likely to be used. The Council of the EU, in its negotiating position of 21 October 2026, keeps the current definition and adds a new provision on pseudonymisation and on when a person is identifiable.

Lawful basis and enforcement

Collecting personal data and training a model on them are processing under the GDPR, so a developer needs a lawful basis, one of the grounds in Article 6(1) on which processing is permitted, such as the person’s consent or a contract with them. Data concerning health, data revealing religious belief and the other special categories listed in Article 9(1) also need one of the conditions in Article 9(2), since Article 9(1) otherwise prohibits processing them. Training data for generative AI are often gathered by web scraping, the automated copying of pages from the internet. The European Data Protection Board considers in its guidelines on web scraping for generative AI, whose consultation also closed on 30 October 2026 and whose final version had not been adopted on that day, that consent would most probably not be an applicable legal basis for scraped data.

Developers therefore often rely on legitimate interests under Article 6(1)(f), which permits processing that is necessary for the legitimate interests of the controller or of a third party, unless the interests, rights and freedoms of the person whose data are used override them, in particular where that person is a child. Opinion 28/2024 applies to AI models the three-step test drawn from the case law of the Court of Justice, and asks supervisory authorities to check that the controller has assessed and documented each step.

The controller has first to pursue an interest that is lawful, clearly articulated, and real and present, and the Opinion gives as an example developing a conversational agent to assist users. The processing has next to be necessary for that interest, which in the Board’s view it is not where the purpose could be pursued with a model that does not involve processing personal data. Finally, the interest has to survive a balancing exercise against the interests, rights and freedoms of the people whose data are used.

Reasonable expectations, in the Board’s view, play a key role in that balancing, judged by such factors as whether the data were publicly available, the website they came from and its privacy settings, and whether people even know that their data are online. Mentioning training in a privacy notice does not, on the Board’s reading, necessarily mean that people can reasonably expect it.

For cases in which people’s interests seem to outweigh the developer’s, the Opinion lists safeguards a developer may adopt to tip the balance back. Among them are an unconditional right to opt out offered from the outset, before the data are processed, erasure on request beyond the grounds Article 17 lists, and a way for people to report that a model has reproduced their data. For scraping in particular, the Opinion suggests leaving out websites that object to it, for instance through robots.txt, a file in which a website tells automated visitors which pages they may collect.

Relying on legitimate interests also brings in the right to object in Article 21(1), which the Board recalls applies whenever a controller relies on that ground. Any person may object on grounds relating to their particular situation, and the controller then has to stop unless it demonstrates compelling legitimate grounds that override the person’s interests, rights and freedoms, or needs the data for legal claims.

The Opinion also considers the consequences of developing a model unlawfully, for which a supervisory authority that finds an infringement may, in the Board’s view, impose a fine, limit the processing for a time or order erasure of the part of the dataset processed unlawfully. Erasure of the whole dataset or of the model itself may follow where erasing part is not possible, having regard to proportionality and to steps the controller can take to put things right, such as retraining.

A business that later uses such a model, often called a deployer, is expected by the Board, as a controller, to have assessed whether the model was lawfully developed, looking for instance at where the data came from and whether a supervisory authority or court has found an infringement. The Board adds that a model trained unlawfully may afterwards be anonymised, in which case, if it can be shown that the model’s later operation does not involve personal data, the GDPR would not apply to that operation and the unlawful training should not affect it. A mere assertion of anonymity is not enough, and supervisory authorities can still act against the unlawful training and against the processing involved in anonymising the model. The Hamburg authority had come to a broader conclusion in its 2024 paper, that unlawful training does not affect the lawfulness of using a model in an AI system at all.

In the United Kingdom the UK GDPR keeps the same legitimate interests test in Article 6(1)(f). The Data (Use and Access) Act 2025 added a further lawful basis, recognised legitimate interests, in Article 6(1)(ea), in force since 5 February 2026. Processing on that basis has to meet a condition in Annex 1 to the UK GDPR, inserted by Schedule 4 to the 2025 Act, and the text of Article 6(1)(ea) omits the balancing test of point (f).

Annex 1’s conditions concern disclosures requested for tasks in the public interest, national security, public security and defence, emergencies, crime and safeguarding vulnerable people, and training a general-purpose model is not among them. A developer in the United Kingdom training such a model on legitimate interests is therefore ordinarily left with Article 6(1)(f) and its balancing test, and whether the crime or safeguarding condition could cover training a model built to detect crime or protect vulnerable people is open.

The ICO said in its December 2024 response that, based on current practices, legitimate interests is in its view the only lawful basis available for training generative AI on personal data scraped from the web, and then only where the developer passes the three-part test, including necessity. Whether training needs web-scraped data at all is still open on the ICO’s account, so a developer seeking to show that it does should explain why it is unable to use other sources of data. Developers that do not tell people clearly what they collect may, the ICO added, struggle to pass the balancing test.

The EU’s test may also change, since the Commission’s Digital Omnibus proposal would add to the GDPR an Article 88c saying expressly that processing necessary for the controller’s interests in developing and operating an AI system or model may be pursued for legitimate interests where appropriate. Article 88c would keep the balancing test and an exception where other law explicitly requires consent, and would require safeguards, for which the proposal gives examples, among them an unconditional right to object.

The Council’s negotiating mandate of 21 October 2026 keeps the provision as an Article 88 bis but replaces the unconditional right to object with the ordinary right in Article 21, and a new recital states that developing or operating an AI system or model “does not in itself constitute a legitimate interest”. Negotiations with the European Parliament were to start once the Parliament had adopted its own position, so the proposal was not law on 29 October 2026.

The GDPR is enforced mainly by the national supervisory authorities, and Italy’s authority, the Garante per la protezione dei dati personali, announced on 20 December 2024 a fine of €15 million on OpenAI. The fine was imposed by a decision of 2 November 2024, at the end of an investigation opened in March 2023.

OpenAI had, according to the Garante, trained ChatGPT on users’ personal data without first identifying an adequate legal basis, had failed to be transparent with users and to notify it of a personal data breach of March 2023, and had not provided a way to check users’ ages. The Garante also ordered OpenAI to run a six-month information campaign about how ChatGPT collects data for training and how people can object.

OpenAI had meanwhile set up its European headquarters in Ireland. The Garante’s decision found the infringements it had earlier notified to OpenAI, and the Garante sent the file to the Irish Data Protection Commission, as OpenAI’s new lead supervisory authority, to continue investigating any infringements still ongoing; a lead supervisory authority is the one that leads on a company’s processing across EU borders. The Court of Rome annulled the Garante’s decision in a judgment published on 18 March 2026, holding that once OpenAI’s Irish company became its single establishment in the European Economic Area, from 15 February 2024, the whole case, completed infringements included, should have passed to the Irish authority under the one-stop-shop rules. The court did not examine the Garante’s other findings, and the Garante’s notice, which says the decision has been removed from its website for the time being, does not say whether the judgment has been appealed.

On 30 January 2025 the Garante ordered, as a matter of urgency, the two Chinese companies behind the DeepSeek chatbot to limit their processing of the data of users in Italy. Its order followed the companies’ statement that they did not operate in Italy and that European law did not apply to them, and the Garante opened an investigation at the same time.

In May 2025 the Garante announced a fine of €5 million on Luka Inc., the US company behind the Replika chatbot, for failing to identify a legal basis for its processing and to check users’ ages. A separate investigation, opened at the same time, concerns how the language model behind Replika was developed and trained, and the Garante’s notice on the fine records that an appeal against the decision is pending.

Under the GDPR’s one-stop-shop system in Article 56(1), the supervisory authority of the country where a company has its main establishment in the EU leads on its cross-border processing. The Irish Data Protection Commission, the DPC, therefore supervises many large technology companies with European headquarters in Ireland, and it reported in September 2026 that most of its engagements on AI between 2021 and 2025 ended with recommendations.

Meta told the DPC in March 2024 that it planned to train its large language model on public content that adults had shared on Facebook and Instagram across the EU, and paused in June 2024 after the DPC raised concerns. In September 2024 the DPC asked the Board for an opinion on questions about training and deploying AI models, seeking harmonisation across Europe, and that request became Opinion 28/2024. In a statement of 21 May 2025, the DPC listed changes Meta had made before its planned start of training on 27 May 2025, among them clearer notices, an easier objection form, de-identification, filtering of datasets and output filters, programs that screen a model’s answers.

A German consumer association asked the Higher Regional Court of Cologne for an urgent injunction to stop Meta’s training, and on 23 May 2025 the court refused it. On the summary examination available in urgent proceedings, the Cologne court found that Meta could rely on legitimate interests. The court also considered data about other people that users had posted, which may include special categories of data, such as data about health or religious belief. On the court’s provisional view, the GDPR’s ban on processing those categories applied in that case only once the person concerned asked for removal, subject to a possible reference to the Court of Justice in main proceedings.

The DPC engaged in the same way with LinkedIn, which told it in March 2025 that it planned to train generative AI models on its members’ data. The DPC’s statement of 7 November 2025 said that it had not approved, or found compliant, LinkedIn’s use of members’ data to train generative AI models, although further intervention was not considered necessary at present. An inquiry that the DPC opened in April 2025 concerns whether X Internet Unlimited Company lawfully processed EU users’ public posts on X to train the Grok models, and in February 2026 the DPC opened a second inquiry into sexualised images of real people, children included, apparently generated with Grok on X. The DPC’s press releases had not announced a decision in either inquiry by 29 October 2026.

UK practice has followed a similar path, and the ICO said in a statement of 13 September 2024 that Meta had paused its plans for UK users at the ICO’s request and made it simpler to object. In the same statement the ICO said that it had not provided regulatory approval for the processing, and that it was for Meta to ensure and demonstrate ongoing compliance.

The ICO’s enforcement action against Clearview AI concerns personal data scraped to build an AI tool, since Clearview, a US company, copied images of people from the web and social media into a database its customers could search by facial recognition. Clearview was fined £7.5 million by the ICO in May 2022 and appealed to the First-tier Tribunal, which held in October 2023 that the ICO lacked jurisdiction. In October 2025 the Upper Tribunal, which hears appeals from the First-tier Tribunal, allowed the ICO’s appeal and sent the case back to the First-tier Tribunal to decide Clearview’s challenge on its merits. The ICO’s page records that the Upper Tribunal gave Clearview permission to appeal to the Court of Appeal, and Find Case Law, the National Archives’ database of judgments, did not hold a Court of Appeal judgment in the case on 29 October 2026.

Erasure, accuracy and unlearning

The GDPR gives a person the right in Article 16 to have inaccurate personal data about them rectified without undue delay. Article 17 gives a right to erasure where one of the grounds it lists applies, such as data that are not needed any longer for their purpose, an objection under Article 21(1) that the controller is unable to override, or unlawful processing. The right to erasure is subject to exceptions that include freedom of expression and legal claims.

UK law keeps both rights in the UK GDPR’s own Article 16 and Article 17. The accuracy principle in Article 5(1)(d) of both texts requires every reasonable step to be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.

Each of these rights assumes that the controller can find the data and change them, which a database allows and a weight file does not, since what a model learned about one person is spread across numbers that also hold everything else it learned, as The transformer, an Intermediate module, explains. Deleting a person’s documents from the training data afterwards leaves the trained weights exactly as they were.

Developers responding to the ICO’s consultation mainly argued that retraining a model to remove the influence of personal data would be impractical or not technically feasible. Requests for correction and erasure should, in their view, be handled at the application level, especially through output filters that block or change answers about a particular person. The application here is the AI system built around the model, such as a chatbot, and a filter alters what the system says while the weights stay the same.

The ICO’s December 2024 response and the Hamburg authority’s 2024 paper took different views on whether a filter is enough to meet those rights, and the Board has not said. Opinion 28/2024 lists output filters, and post-training techniques that try to remove or suppress personal data, among measures that supervisory authorities may weigh case by case in the legitimate interests balancing, without saying whether a filter meets the rights to rectification and erasure. The Board’s guidelines on web scraping observe that with today’s techniques personal data are not easily deleted from a model once it has been trained.

In its December 2024 response, the ICO said that output filters may not be sufficient, since they do not actually remove the data from the model. Controllers need, in the ICO’s view, ways to respond to requests about the training data and, where a model contains personal data, about the model itself. Without effective tools of that sort, the ICO added, the processing of a developer or a deployer may be unlawful, depending on the lawful basis it relies on.

Not every right is absolute, the ICO added, and a controller relying on legitimate interests need not erase data, in its view, if an overriding legitimate interest in continuing the processing remains and also passes the three-part test, although each request has to be considered case by case. That exception, in the ICO’s view, does not extend to rectification where the person has evidence that the data are inaccurate. The Hamburg authority took a different view in its 2024 paper, considering that the accuracy principle and the rights to rectification and erasure apply to the inputs and outputs of the AI system and not to the model itself.

The gap between a filter and a change to the weights is at the centre of a complaint that noyb, a privacy campaign group, filed with Norway’s data protection authority, Datatilsynet, on 20 March 2025 on behalf of Arve Hjalmar Holmen. According to the complaint, ChatGPT answered a question about Mr Holmen with an invented story that he had murdered two of his children and been sentenced to 21 years in prison, mixed with true details such as the number and sex of his children and the name of his home town.

The complaint relies on the accuracy principle in Article 5(1)(d) of the GDPR and asks for the output to be deleted and the model fine-tuned to stop producing inaccurate results. The group says that ChatGPT stopped repeating the story once OpenAI let it look people up on the internet when asked who they are, presumably because its answers then draw on what the search finds, but that the false information may remain part of the model’s data. In answer to noyb’s earlier complaint of April 2024, about a public figure’s wrong date of birth, OpenAI said, according to noyb, that it was unable to correct data and could only block it for certain prompts.

Those are noyb’s allegations, and the group’s case page recorded on 29 October 2026 that the Irish DPC had become the lead supervisory authority for the complaint and that the complaint was pending.

Machine unlearning is the research field that tries to remove the influence of particular training data from a model that has already been trained, without training a new model from the start. Its limits are the subject of a paper on machine unlearning led by A. Feder Cooper, first posted in December 2024 and revised in October 2025, which concludes that unlearning is not a general-purpose solution for controlling what generative models produce.

Retraining a new model from scratch without the unwanted data is often called the “gold standard”, a label the authors put in quotation marks because retraining removes only information directly present in the training data. Retraining is also expensive, often prohibitively so for the largest models trained today on enormous datasets. Faster methods that adjust an existing model’s weights to approximate retraining often offer, according to the paper, a probabilistic guarantee, “not absolute certainty”. The faster methods were developed almost entirely for supervised machine learning, in which a model learns from examples marked with the right answer, such as emails marked as spam, and not for generative AI.

Even a model retrained without a person’s data may, the authors explain, produce information resembling what was removed, since it can generalise from similar data about other people and combine that with details about the person supplied in a prompt. Unlearning may therefore reduce what a model has absorbed about a person without guaranteeing what it will say about them.

Automated decisions

A language model may be used to score, rank or screen people, for instance to sift job applications or to assess a customer, and that use brings in the GDPR’s provisions on automated decisions explained in Looking inside and testing, an Advanced module. Under Article 22(1) of the GDPR, which the Court of Justice reads as a prohibition in principle, a person has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. Exceptions cover decisions needed for a contract, decisions authorised by law with safeguards, and decisions based on the person’s explicit consent. For the contract and consent exceptions the controller has to provide safeguards that include at least the right to obtain human intervention, to express a point of view and to contest the decision, with further limits where special categories of data are used.

In SCHUFA, decided on 7 December 2023, the Court of Justice held that a credit agency’s automated calculation of a score about a person is itself such a decision in one situation. The situation is where a third party to which the score is passed draws strongly on it in deciding whether to enter into, perform or end a contract with that person.

Any business that supplies scores produced by a language model to clients who lean heavily on them may therefore need to consider Article 22 for its own processing, although whether a court would apply SCHUFA in that way to a language model is open.

For automated decisions, the Court held in Dun & Bradstreet Austria that the right of access in Article 15(1)(h) entitles the person to an explanation of “the procedure and principles actually applied”, which lets them understand which of their personal data were used and how. Telling the person how far a change in the data taken into account would have led to a different result could, the Court added, be enough for the national court to find the explanation sufficiently transparent.

Those requirements fit a language model awkwardly, since the same input can produce different answers from one run to the next, and the reasoning a model writes out may not reflect what in fact drove its answer, as Does AI reason?, a Beginner module, explains. Describing the procedure actually applied, or testing how the result moves when an input changes, is therefore harder for a language model than for a scoring formula.

That difficulty favours designs in which the model assists a person who takes the decision and can explain it. The GDPR does not define “solely”, and the Court of Justice has not ruled on how much human involvement takes a decision outside Article 22. The Article 29 Working Party, the independent European advisory body set up under the directive the GDPR replaced, issued guidelines on automated decision-making, which the Board endorsed on 25 May 2018. The guidelines say that a controller may not avoid Article 22 “by fabricating human involvement”. Oversight has to be “meaningful”, in the guidelines’ words, and exercised by someone with the “authority and competence to change the decision”. On that view, a person who merely approves the model’s output, without any actual influence on the result, would not stop the decision counting as solely automated.

In the United Kingdom, section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D, in force since 5 February 2026 under the commencement regulations. Decisions taken before that date to which the former Article 22 safeguards applied remain under the former provisions. Article 22A treats a decision as based solely on automated processing where a human is not meaningfully involved in taking it, and defines a significant decision as one that produces a legal effect, or a similarly significant effect, for the person.

Article 22B restricts solely automated significant decisions that rest on special categories of data, and bars any solely automated significant decision for which the processing relies, wholly or partly, on recognised legitimate interests. Outside those cases, the new articles appear to allow solely automated significant decisions based on personal data, provided the controller puts in place the safeguards in Article 22C, which give the person information about the decision and enable them to make representations, obtain human intervention and contest it.

Whether UK courts will look to Dun & Bradstreet Austria when deciding how much a controller has to explain about such decisions is open. The judgment, given after the Brexit transition period ended, does not bind them, although section 6(2) of the European Union (Withdrawal) Act 2018 lets them have regard to it so far as it is relevant. The ICO consulted on draft guidance on the new articles between 31 March and 29 May 2026.