Where a significant decision about a data subject is based wholly or partly on personal data and solely on automated processing, the controller must ensure safeguards are in place that give the data subject information about such decisions taken about them, enable them to make representations, enable them to obtain human intervention by the controller, and enable them to contest the decision, together with anything regulations under Article 22D(3) add. Article 22D lets regulations specify when human involvement is or is not meaningful and which decisions have a similarly significant effect. The Information Commissioner must prepare a statutory code of practice on AI and automated decision-making (S.I. 2026/425 under section 124A of the 2018 Act).
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.