Aipedia: Payroll bureaux

Automated payroll decisions and UK GDPR

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Some automated payroll decisions, such as deductions, sick pay eligibility or overpayment recovery, may be solely automated significant decisions under UK GDPR Articles 22A to 22D. Since 5 February 2026 those require safeguards, and the bureau must help its employer client provide them.

Part of: AI in payroll bureaux

In short

Articles 22A to 22D of UK GDPR, inserted by section 80 of the Data (Use and Access) Act 2025, have applied since 5 February 2026. They set safeguards for decisions based solely on automated processing that have significant effects on individuals. Payroll decisions such as stopping sick pay, recovering an overpayment or applying a deduction without meaningful human review may fall within them. The employer is usually the controller and the bureau a processor under Article 28 terms. Employees may complain or claim compensation, and processors can be liable in some circumstances. ICO final guidance on automated decision-making under the Act was still awaited as at October 2026.

What changed on 5 February 2026

Section 80 of the Data (Use and Access) Act 2025 inserted Articles 22A to 22D into UK GDPR, brought into force on 5 February 2026 by SI 2026/82. They deal with significant decisions based solely on automated processing and require safeguards. The ICO consulted on guidance under the new provisions, and the consultation closed on 29 May 2026; final guidance had not been published as at October 2026. The ICO's general AI guidance still applies.

Which payroll decisions might be caught

Much of payroll is automated arithmetic carrying out decisions people have already made, such as paying the agreed salary. The question is whether a decision with significant effects on an employee is made solely by automated means, without meaningful human involvement. Payroll examples that may need to be considered include:

an AI tool deciding that an employee is not eligible for statutory sick pay from a fit note, and stopping payment;
automatic recovery of an overpayment from net pay, with the amount and timing set by the system;
deductions applied by a tool that has interpreted a court order or policy itself;
auto-enrolment or opt-out outcomes decided by a tool without review.

Each depends on the facts. A human who genuinely reviews the decision and can change it usually takes it outside "solely automated". A person who only clicks approve on whatever the tool proposes may not. See AI for statutory payments and attachment of earnings.

The bureau's processor role

The employer usually decides why and how employee data is processed, so it is the controller. The bureau processes data on its instructions and is a processor, which requires Article 28 terms. In practice, though, the bureau often chooses the tools and designs the workflow, so it is the party best placed to know whether a decision is solely automated. It should tell clients where automation makes decisions, support them in providing safeguards, and avoid making decisions outside its instructions. Sickness records are health data, which is special category data, which makes this more sensitive. Health data and HR processing are also covered in ICO and DUAA AI rules for HR advisers.

Employee data claims and PI

An employee affected by an unlawful automated decision may complain to the employer and the ICO, or claim compensation. Under Article 82, a processor can be liable where it has not complied with processor obligations or has acted outside lawful instructions; see Article 82 compensation and processors. The employer may also claim against the bureau under the contract.

Whether the bureau's PI responds depends on the wording. Some PI policies include data protection liability, and others leave it to cyber cover. ICO fines are usually excluded or uninsurable. See GDPR cover within PI and GDPR fines versus civil claims.

Practical controls

These steps help a bureau and its clients manage automated decisions:

Map which payroll decisions are made by automation without human review.
Build meaningful human review into decisions that stop or reduce pay.
Tell clients in writing where tools make decisions, so they can update privacy notices and DPIAs.
Keep records of who reviewed each decision and why.
Provide a route for employees to challenge a decision and reach a person.
Review the position again when the ICO publishes final guidance on automated decision-making.
Check your AI tool provider's terms so it does not use payroll data for its own purposes.

How Apex helps

Apex arranges professional indemnity for payroll bureaux. A broker can check whether your PI or cyber cover responds to data protection claims about automated payroll decisions. See also AI in payroll bureaux.

Sources

Frequently asked

When did UK GDPR Articles 22A to 22D come into force?

On 5 February 2026. They were inserted by section 80 of the Data (Use and Access) Act 2025 and commenced by SI 2026/82. They set safeguards for significant decisions based solely on automated processing.

Is automated payroll processing an automated decision under Article 22A?

Not usually where it simply carries out decisions people have made, such as paying an agreed salary. Decisions with significant effects made by a tool without meaningful human review, such as stopping sick pay or recovering an overpayment, may need to be considered.

Is the payroll bureau the controller or processor?

The bureau is typically a processor acting for the employer, which is the controller, and needs Article 28 terms. A bureau that makes decisions outside its instructions risks being treated differently and taking on more responsibility.

Does PI cover employee claims about automated decisions?

It depends on the wording. Some PI policies include data protection liability, while others leave it to cyber cover. Regulatory fines are usually excluded or uninsurable, so both policies should be checked together.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.