UK GDPR expects decisions about people to be fair, accurate and lawful, and gives people safeguards when decisions are automated. Staff who review AI agent decisions in UK firms carry much of that load. They must be trained to check facts, apply real judgement, handle requests for human intervention and contest, and answer subject access requests that reach agent records.
What does UK GDPR ask of staff who review agent decisions?
UK GDPR, read with the Data Protection Act 2018, is the UK's general data protection law, enforced by the ICO. Several of its duties land on reviewers.
- Article 5 principles. Processing must be lawful, fair and transparent, and personal data must be accurate. A reviewer who releases an agent decision built on wrong facts, or that treats someone unfairly, is where those principles fail.
- Article 6 lawful basis. Each use of personal data needs a basis. Reviewers rarely choose it, but they should know when an agent's reasoning draws on data used outside its purpose.
- Article 22 and automated decisions. UK law restricts or conditions significant decisions based solely on automated processing. Parliament has legislated to reform these rules, widening when such decisions may be made while keeping safeguards: information about the decision, the chance to make representations, human intervention and the ability to contest. Decisions based on special category data remain more restricted. Firms should confirm which provisions apply.
- Article 35 impact assessments. High-risk processing, which includes most agents that profile or decide, needs a DPIA, and the DPIA should describe how review works.
- Article 30 records. Processing must be recorded; agent processing belongs in that record.
- Rights. People can access their data, have it corrected and object to some processing.
The system side is set out in UK GDPR Article 22 and AI agents in UK firms.
Who does it apply to?
Controllers and processors in the UK, and those outside the UK offering goods or services to people in the UK or monitoring them. Financial firms also answer to the FCA, including under the Consumer Duty, and the PRA; payment firms answer to the PSR on payment system rules, including those on reimbursing many victims of authorised push payment scams. Reviewers in scope include credit analysts, payments operations staff, fraud analysts, claims handlers, HR advisers, complaints staff and caseworkers. For a UK sector view, see what AI agent training organisations in the UK need.
What must reviewers be trained to do?
Check accuracy before release. An agent's draft decision rests on facts. Reviewers must see each fact's provenance: sealed from the system of record, signed by a named party, declared by the customer, or external. Decisions should rest on the strongest class available, and reviewers should correct the record when they find an error.
Judge fairness, not just correctness. A decision can follow policy and still be unfair to the person in front of you, for example by ignoring vulnerability. Reviewers must have authority to depart from the agent and use it.
Provide human intervention properly. When someone asks for a person, the reviewer must re-decide with full information and the power to change the outcome. Confirming the agent's answer without looking does not meet the safeguard.
Handle representations and contests. A person's own account is new evidence. Reviewers must weigh it and explain the result.
Answer subject access requests that reach agents. Agent records, reasons and summaries about a person can be personal data. Reviewers and complaints staff must know where they sit and that every verdict is filed in an append-only record that may need searching.
Know the agent's bounds. Each capability has a depth: read at 1, draft at 2, execute routine work at 3, move money at 4. Reviewers should know which they are seeing, and that a held action waits for them while a refused one was outside the agent's bounds. In payments, releasing money is depth 4; how payments operations staff review an AI agent's decisions covers that work, and AI agent training for payments operations staff in retail banking in the UK sets out the role.
How do you meet UK GDPR and show it?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Accuracy | Reviewers see provenance and correct errors at source | Review notes; corrections logged |
| Fairness | Reviewers have override authority; outcomes monitored by group | Override records; outcome reports |
| Automated decision safeguards | Significant decisions held or open to intervention and contest | Hold logs; intervention and contest records |
| Competent reviewers | Training and assessment on the specific agent before release rights | Assessment results; access grants |
| DPIA under Article 35 | Assessment describes the agent and the review design | Approved DPIA |
| Records under Article 30 | Agent processing recorded | Record of processing entries |
| Subject access | Agent records included in searches | Request handling records |
What will the ICO or an auditor ask?
- Which agent decisions are significant, and how are they reviewed?
- Show us a decision a reviewer changed. Why did they change it?
- How do people ask for human intervention, and what happens?
- How were reviewers trained, and are they still current?
- Does your DPIA describe the review?
- How would you answer a subject access request that touches agent records?
Credit is the sector where these questions are sharpest; see Article 22 and training reviewers in credit decisions.
What does UK GDPR not cover?
It does not set conduct rules for financial firms; the FCA and PRA do. It does not regulate the agent as a product, or set model risk standards; PRA SS1/23 covers that for banks. It does not prescribe training content. And the UK takes a principles-based, regulator-led approach to AI rather than a single AI law, so sector expectations add to it. The guide to AI literacy and certification covers the wider model.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where the Academy fits
Pryme Intelligence Academy's Operator track is built for UK reviewers who run a live workspace every day. It covers how a governed agent decides, human review, teaching the agent and when something goes wrong. Certified Pryme Operator is valid for 12 months; renewal is an update module and a short quiz, which keeps reviewers current as agents change.
Questions people ask
Does UK GDPR still restrict automated decisions?
Yes, though the rules have been reformed. Safeguards such as human intervention and the right to contest remain, and special category data stays more restricted.
Are agent reasons personal data?
Reasons about a person usually are. Include them in subject access searches.
Who should review significant agent decisions?
A trained person with authority to change the outcome and access to the full evidence.