Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, to what extent are automated decision-making systems used in relation to employment by her Department, including recruitment, performance management, discipline, or allocation of work.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, what steps her Department has taken to ensure that human oversight of automated decisions is (a) substantive and (b) effective.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, what consultation has taken place with recognised trade unions regarding the introduction or use of automated decision-making systems affecting staff within her Department.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

While no formal consultation has yet taken place, we recently met with our recognised trade unions to provide an update on AI adoption in the department. There is currently no use of automated decision making within the department; however, should circumstances change, the department will meet its obligations under our trade union partnership arrangements and engage fully through formal routes.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, what steps has the Department taken to assess and mitigate risks of bias or discrimination arising from the use of automated decision-making systems.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, whether the Department maintains a public register or internal inventory of automated decision-making systems.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, given the passage of the Data (Use and Access) Act 2025 what safeguards have been implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review, and challenge.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, given the passage of the Data (Use and Access) Act 2025 what guidance has the Department issued internally to ensure compliance with the provisions of the 2025 Act in relation to automated decision-making.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, on what basis Automated Decision-Making in her Department are being made.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, how her Department define and ensure meaningful human involvement in decisions supported or made by automated systems in the context of the Data (Use and Access) Act 2025.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, what processes are in place within his Department to enable individuals to seek human review and to challenge decisions made by automated systems.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, how individuals are informed by his Department that decisions affecting them have been taken, in whole or in part, by automated means.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

There is no automated decision making in DCMS affecting individuals. Any automated outputs are always verified, edited, reviewed and owned by a human. Our training and guidance to staff reinforce these principles.

Processing of personal data through part automation is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing, as well as human oversight and accountability on any output.

Question to the Department for Work and Pensions:

To ask the Secretary of State for Work and Pensions, what assessment he has made of the rate at which Universal Credit claimants aged 18 to 24 are sanctioned compared with older claimants; and whether he plans to review the application of sanctions to different age groups.

Answered by Diana Johnson - Minister of State (Department of Health and Social Care)

The latest published Universal Credit sanction rate figures for claimants aged 20 to 24 for February 2026 are available in the latest Benefit Sanction Statistics bulletin and accompanying data tables to February 2026, as well as through Stat-Xplore from the UC Sanction Rates dataset.

The Department keeps the operation of conditionality and sanctions under continuous review to ensure the system remains fair and proportionate.

Question to the Department for Work and Pensions:

To ask the Secretary of State for Work and Pensions, whether his Department has assessed the impact of Universal Credit sanctions on the confidence, wellbeing and long-term employment outcomes of young people aged 18 to 24.

Answered by Diana Johnson - Minister of State (Department of Health and Social Care)

The latest published Universal Credit sanction rate figures for claimants aged 20 to 24 for February 2026 are available in the latest Benefit Sanction Statistics bulletin and accompanying data tables to February 2026, as well as through Stat-Xplore from the UC Sanction Rates dataset.

The Department keeps the operation of conditionality and sanctions under continuous review to ensure the system remains fair and proportionate.

Question to the Department for Digital, Culture, Media & Sport:

To ask the Secretary of State for Culture, Media and Sport, given the passage of the Data (Use and Access) Act 2025 how does the Department ensure compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.

Answered by Ian Murray - Minister of State (Department for Digital, Culture, Media and Sport)

Processing of personal data, and especially special category data, is subject to a Data Protection Impact Assessment, confirming the lawful basis for processing. There is no automated decision making in DCMS affecting individuals. The DPIA process identifies potential risks and documents the appropriate measures to mitigate those risks.

Question to the Foreign, Commonwealth & Development Office:

To ask the Secretary of State for Foreign, Commonwealth and Development Affairs, what assessment she has made of the implications for her policies of the recommendation in the report of the UN Independent International Commission of Inquiry on the Occupied Palestinian Territory, including East Jerusalem, and Israel that Member States conduct investigations under domestic or universal jurisdiction of individuals suspected of participating in unlawful acts of violence against Palestinian children, including dual nationals.

Answered by Hamish Falconer - Minister of State (Cabinet Office) (Jointly with the Foreign, Commonwealth and Development Office)

The UK has always recognised the right of British dual nationals to serve in the legitimately recognised armed forces of the country of their other nationality. But as with any conflict, anyone who travels overseas to fight, or to assist others engaged in conflict, may commit offences under UK law if they fail to act consistently with applicable international law, and could face investigation and prosecution on their return to the UK.

Those are decisions for the operationally-independent police and Crown Prosecution Service to take, based on the evidence in each individual case. Anyone who has evidence of a British national engaging in illegal activity should submit it to the Met Police, including any violations of the rights of children under International Humanitarian Law, of the kind alleged in the UN report to which the Hon Member refers.

Question to the Foreign, Commonwealth & Development Office:

To ask the Secretary of State for Foreign, Commonwealth and Development Affairs, with reference to the report of the UN Independent International Commission of Inquiry on the Occupied Palestinian Territory, including East Jerusalem, and Israel, what assessment she has made of the adequacy of existing prosecutorial guidance relating to offences under the International Criminal Court Act 2001 allegedly committed overseas by UK nationals or dual nationals.

Answered by Hamish Falconer - Minister of State (Cabinet Office) (Jointly with the Foreign, Commonwealth and Development Office)

The UK has always recognised the right of British dual nationals to serve in the legitimately recognised armed forces of the country of their other nationality. But as with any conflict, anyone who travels overseas to fight, or to assist others engaged in conflict, may commit offences under UK law if they fail to act consistently with applicable international law, and could face investigation and prosecution on their return to the UK.

Those are decisions for the operationally-independent police and Crown Prosecution Service to take, based on the evidence in each individual case. Anyone who has evidence of a British national engaging in illegal activity should submit it to the Met Police, including any violations of the rights of children under International Humanitarian Law, of the kind alleged in the UN report to which the Hon Member refers.

Question to the Foreign, Commonwealth & Development Office:

To ask the Secretary of State for Foreign, Commonwealth and Development Affairs, whether allegations that a UK national or dual national committed offences under the International Criminal Court Act 2001 while serving with the Israel Defense Forces would be investigated by the appropriate UK law enforcement authorities where there is sufficient evidential basis.

Answered by Hamish Falconer - Minister of State (Cabinet Office) (Jointly with the Foreign, Commonwealth and Development Office)

The UK has always recognised the right of British dual nationals to serve in the legitimately recognised armed forces of the country of their other nationality. But as with any conflict, anyone who travels overseas to fight, or to assist others engaged in conflict, may commit offences under UK law if they fail to act consistently with applicable international law, and could face investigation and prosecution on their return to the UK.

Those are decisions for the operationally-independent police and Crown Prosecution Service to take, based on the evidence in each individual case. Anyone who has evidence of a British national engaging in illegal activity should submit it to the Met Police, including any violations of the rights of children under International Humanitarian Law, of the kind alleged in the UN report to which the Hon Member refers.

Question to the Department for Work and Pensions:

To ask the Secretary of State for Work and Pensions, what assessment his Department has made of the potential impact of Universal Credit conditionality on the likelihood of young people entering employment that matches their skills, qualifications and long-term career aspirations.

Answered by Diana Johnson - Minister of State (Department of Health and Social Care)

As part of the Government’s investment of an additional £2.5 billion over the next three years in the Youth Guarantee and the Growth and Skills Levy, young people are now benefiting from expanded Jobcentre support through the Youth Guarantee. This enhanced support provides young people on Universal Credit and looking for work tailored employment support and a structured path into a job, apprenticeship, work experience, SWAP, learning or training from their first appointment in the Jobcentre.

Work coaches have conversations with claimants to understand their individual circumstances and experience, including taking into account a claimant's skills, qualifications and long-term career aspirations, in order to tailor their work-related requirements and employment support opportunities.

For some claimants with a strong employment history, work coaches may also agree a period during which job search activity is focused on roles similar to their previous occupation. However, it may not always be possible to support claimants into roles that meet their skills and aspirations, for example, when their preferred roles are not available in the local labour market. In these cases, Work Coaches will support them into other suitable employment opportunities.

As part of our broader plans to Get Britain Working, we are creating a Jobs and Careers Service, with an enhanced focus on skills and careers. As part of this, we have set up three Pathfinders to test how employment, skills and wider support can work together to meet local labour market needs. This includes a Pathfinder based in the East Midlands, which is focussed on young people (aged 16-24), particularly those not in education, employment or training (NEET), exploring how tailored support, skills provision and Youth Hub models can help young people to move closer to, enter, and remain in work.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, whether the Department maintains a public register or internal inventory of automated decision-making systems.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

For automated decision making systems that use algorithms, information about these is made publicly available on the Algorithmic Transparency Records Standards (ATRS) hub https://www.gov.uk/algorithmic-transparency-records. This is maintained by the Department for Science Innovation and Technology (DSIT). Otherwise, we maintain no internal or public registers.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what consultation has taken place with recognised trade unions regarding the introduction or use of automated decision-making systems affecting staff.

Answered by Satvir Kaur - Parliamentary Under-Secretary (Home Office)

The UK’s data protection legislation is a principles-based framework and does not prescribe specific consultation requirements for particular operational systems. Organisations are responsible for applying the requirements of the legislation within their own operational context and must ensure any processing of personal data complies with applicable legal requirements.

In the case of the Cabinet Office, there has been no consultation between the Cabinet Office and recognised trade unions regarding the introduction or use of automated decision making systems affecting staff.

However, it is acknowledged that the relationship between the Cabinet Office and recognised trade unions is of significant importance and that any potential future consultation on this subject will be conducted fully in line with the principles of the Cabinet Office and trade union partnership framework.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, how are automated decision-making systems used in relation to civil service employment, including recruitment, performance management, discipline and allocation of work.

Answered by Satvir Kaur - Parliamentary Under-Secretary (Home Office)

The UK’s data protection legislation does not lay down specific rules regarding particular employment systems. It is for each organisation to determine how it applies the data protection framework in its operational context. Where individuals are subject to significant decisions based solely on automated processing, the legislation provides safeguards including rights to information, challenge and human intervention.

In the Cabinet Office, no automated decision-making systems are used in relation to:

• Recruitment;

• Performance management (for both delegated and Senior Civil Service grades);

• Discipline; or

• The allocation of work.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, how does the Department ensure compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

The Cabinet Office maintains a robust data protection governance framework to ensure all personal data, including special category data and data relating to protected characteristics, is processed in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

Following the passage of the 2025 Act, the Department continues to mandate rigorous Data Protection Impact Assessments (DPIAs) for high-risk processing, alongside a standard practice of conducting comprehensive data protection compliance audits across the entire Cabinet Office.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what processes are in place to enable individuals to seek human review and to challenge decisions made by automated systems.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.

The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.

Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what measures are in place to ensure that human oversight is substantive and effective.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.

The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.

Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what safeguards have been implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review, and challenge.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.

The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.

Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, under what statutory authority are significant Automated Decision-Making being made or intended to be made.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.

The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.

Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, how individuals are informed that decisions affecting them have been taken, in whole or in part, by automated means.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

To the extent that the Cabinet Office relies on automated decision making, we rely on our prerogative powers as a Crown department rather than specific legislation.

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems. The ICO recently consulted on its updated guidance about automated decision-making, including profiling, in light of the reforms to the rules in the Data (Use and Access) Act.

The Cabinet Office mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. All DPIAs are reviewed by data protection specialists, including the Deputy Data Protection Officer and Data Protection Officer, to ensure that data protection legislation will be complied with, including requirements for meaningful human involvement in automated systems. This process involves reference to ICO guidance, the Data and AI Ethics Frameworks, and other relevant authoritative guidance.

Data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office provides ongoing training, communications, and bespoke support, as well as quarterly assessments and periodic audit validations of Business Units to ensure data protection policies, such as the DPIA process and data subject rights handling, are being followed.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, what steps has the Department taken to assess and help prevent bias and discrimination following the use of automated decision-making systems.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems.

The government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture. Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.

As such, the government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.

The Cabinet Office ensures 'meaningful' human involvement by requiring that active oversight is applied by informed staff who possess the clear authority and technical capability to overturn automated outputs.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making (ADM), while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government has required the ICO to produce a Code of Practice on Artificial Intelligence and solely automated decision-making, and the ICO has published guidance on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations.

To support this, the Cabinet Office has updated internal guidance which mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. These assessments proactively evaluate bias risks against the HMG 'Ethics and Bias' guidance, while targeted testing ensures compliance with the Public Sector Equality Duty (PSED) by preventing system designs from creating unfair outcomes for protected groups.

Furthermore, data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office has issued communications, live training, and updated internal guidance across the business to ensure full operational compliance with this reformed framework.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, what guidance has the Department issued internally to ensure compliance with the provisions of the 2025 Act in relation to automated decision-making.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems.

The government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture. Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.

As such, the government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.

The Cabinet Office ensures 'meaningful' human involvement by requiring that active oversight is applied by informed staff who possess the clear authority and technical capability to overturn automated outputs.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making (ADM), while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government has required the ICO to produce a Code of Practice on Artificial Intelligence and solely automated decision-making, and the ICO has published guidance on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations.

To support this, the Cabinet Office has updated internal guidance which mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. These assessments proactively evaluate bias risks against the HMG 'Ethics and Bias' guidance, while targeted testing ensures compliance with the Public Sector Equality Duty (PSED) by preventing system designs from creating unfair outcomes for protected groups.

Furthermore, data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office has issued communications, live training, and updated internal guidance across the business to ensure full operational compliance with this reformed framework.

Question to the Cabinet Office:

To ask the Minister for the Cabinet Office, given the passage of the Data (Use and Access) Act 2025, how does the Department define and ensure meaningful human involvement in decisions supported or made by automated systems.

Answered by James Frith - Parliamentary Under-Secretary (Department of Health and Social Care)

Article 22C of the UK GDPR contains safeguards specific to solely automated decision-making, including profiling, that have legal or similarly significant effects on individuals. Solely automated decision-making is decision-making without “any meaningful human involvement”.

Where individuals have been subject to decisions based solely on automated processing with legal or significant effects on them, the legislation also requires organisations to provide the individual with information about the decision that has been taken, and the right for them to contest that decision and to obtain human intervention on it, if they believe the decision is incorrect or unfair.

The Information Commissioner’s Office (ICO), which is the independent regulator for data protection has taken steps to provide guidance on how data protection law applies specifically to AI systems.

The government does not wish to be overly prescriptive by defining meaningful human involvement, as it is context specific. ICO guidance can be more appropriate than legislation for providing such a definition or interpretation, given guidance can be more easily updated and can provide detail and nuances that legislation would not usually capture. Current ICO guidance sets out that “human involvement [in the decision making] has to be active and not just a token gesture” to be meaningful”. It is for each data controller to determine and be able to demonstrate whether their processing includes meaningful human involvement, as this is context specific.

As such, the government believes in the importance of the ICO continuing to provide its views on interpretation of terms used in the legislation. Our reforms do not remove the ICO's ability to do this, or to advise Parliament or the government if it considers that the law needs clarification.

The Cabinet Office ensures 'meaningful' human involvement by requiring that active oversight is applied by informed staff who possess the clear authority and technical capability to overturn automated outputs.

The Data (Use and Access) Act 2025 introduced reforms to the rules on solely automated decision-making (ADM), while maintaining safeguards for individuals. The Act clarifies that organisations must inform individuals when significant decisions are taken solely by automated means, and individuals retain rights to challenge such decisions and obtain human intervention.

The Government has required the Information Commissioner’s Office (ICO) as the independent data protection regulator to produce a Code of Practice on AI and ADM. This Code will provide authoritative guidance to support organisations with their data protection compliance in this area.

The UK’s data protection framework is underpinned by principles of lawfulness, fairness, transparency and accountability. The Government has required the ICO to produce a Code of Practice on Artificial Intelligence and solely automated decision-making, and the ICO has published guidance on automated decision-making, profiling and artificial intelligence to support organisations in complying with their obligations.

To support this, the Cabinet Office has updated internal guidance which mandates the completion of Data Protection Impact Assessments (DPIAs) early in the design phase of any project involving profiling or automated decision-making. These assessments proactively evaluate bias risks against the HMG 'Ethics and Bias' guidance, while targeted testing ensures compliance with the Public Sector Equality Duty (PSED) by preventing system designs from creating unfair outcomes for protected groups.

Furthermore, data subjects’ right to be informed is upheld by the Cabinet Office through privacy notices, which are also reviewed during the DPIA process. These include information on how and why personal data is processed, associated information including any automated decision-making, and how to contact, challenge, and complain about any aspect of personal data processing by the Cabinet Office.

The Cabinet Office has issued communications, live training, and updated internal guidance across the business to ensure full operational compliance with this reformed framework.

Question to the Department for Education:

To ask the Secretary of State for Education, what safeguards have been implemented to ensure compliance with statutory requirements relating to automated decision-making, including rights to information, human review, and challenge.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, what guidance her Department has issued internally to help ensure compliance with the provisions of the Data (Use and Access) Act 2025 in relation to automated decision-making.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, on what lawful basis are significant Automated Decision-Making being made or intended to be made.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, given the passage of the Data (Use and Access) Act 2025 what measures are in place to ensure that human oversight is substantive and effective, rather than limited to formal or nominal review.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, given the passage of the Data (Use and Access) Act 2025 how individuals are informed that decisions affecting them have been taken, in whole or in part, by automated means.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, what processes are in place to enable individuals to seek human review and to challenge decisions made by automated systems.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, how her Department define and ensure meaningful human involvement in decisions supported or made by automated systems.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, how her Department ensures compliance with data protection requirements relating to the processing of special category data, including data relating to health or protected characteristics.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department ensures compliance with data protection requirements relating to the processing of special category personal data, including data concerning health and protected characteristics, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Data (Use and Access) Act 2025.

The department processes special category data only where there is a lawful basis and a relevant condition for processing under Articles 6 and 9 and of the UK GDPR. The department has appropriate technical and organisational measures to safeguard data, including access controls, data minimisation, secure storage arrangements, and regular monitoring of compliance.

Where processing is likely to present a high risk to individual’s rights, the department undertakes Data Protection Impact Assessments to identify and mitigate risks. Staff receive mandatory data protection and information security training, supported by specialist advice from the department's Data Protection team.

The department also maintains privacy notices and an Appropriate Policy Document, where required, to support transparency and accountability. Compliance arrangements are kept under regular review to ensure processing remains necessary, proportionate and consistent with legal requirements.

Question to the Department for Education:

To ask the Secretary of State for Education, whether the Department maintains a public register or internal inventory of automated decision-making systems; and whether it plans to publish such information.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, what recent discussions she has had with trade union representatives on the introduction or use of automated decision-making systems affecting staff.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, what steps has her Department taken to assess and mitigate risks of bias or discrimination arising from the use of automated decision-making systems.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

Question to the Department for Education:

To ask the Secretary of State for Education, to what extent are automated decision-making systems used in relation to civil service employment, including recruitment, performance management, discipline, or allocation of work.

Answered by Paul Waugh - Parliamentary Under-Secretary (Department for Education)

The department does not use automated decision-making systems to make, or support the making of, decisions relating to staff, citizens or recruitment where outcomes are determined without meaningful human involvement. Similarly, the department does not use automated decision-making systems to make employment-related decisions concerning civil servants. This includes decisions relating to performance management, disciplinary action, or the allocation of work. Accordingly, the specific issues raised regarding automated decision-making, human review, oversight arrangements, bias mitigation, trade union consultation, challenge mechanisms and compliance with the provisions of the Data (Use and Access) Act 2025 are not applicable to the department’s current operations.

The department keeps its use of digital technologies under review and would ensure that any future deployment of automated decision-making systems complies with data protection legislation, regulatory standards and guidance, including requirements relating to transparency, accountability, fairness, human oversight and individuals’ rights to review and challenge decisions where relevant.

30th anniversary of Maggie's Cancer Care

Treatment of security staff employed at the National Gallery

Killing of Mohamed Fawaz al-Wahidi

Estate management charges

30th anniversary of the State Visit of President Nelson Mandela of the Republic of South Africa to the United Kingdom

Nelson Mandela Day

Emmeline Pankhurst Day

Srebrenica Memorial Week

Cancer and access to travel insurance

Prohibiting Members of Parliament from having paid second jobs

Strike action and industrial dispute at Tower Hamlets leisure centres

Richard Pengelly