UK reference extracts for cases 7 and 9. Text of the UK GDPR as revised on legislation.gov.uk, downloaded on 6 November 2026 (latest available revision, including the changes made by the Data (Use and Access) Act 2025). Extracts only: the full articles are at the URLs given. ICO guidance quoted from the PDF version 1.0.0 of 4 October 2023, which predates the Data (Use and Access) Act 2025 and still refers to the old Article 22.

UK GDPR - Article 5 (Principles relating to processing of personal data)
https://www.legislation.gov.uk/eur/2016/679/article/5
1. Personal data shall be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ('lawfulness, fairness and transparency');
(b) collected (whether from the data subject or otherwise) for specified, explicit and legitimate purposes and not further processed by or on behalf of a controller in a manner that is incompatible with the purposes for which the controller collected the data ('purpose limitation');
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation');
[...]
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 84B ('storage limitation');
[...]
2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 ('accountability').

UK GDPR - Article 9(1) (Processing of special categories of personal data)
https://www.legislation.gov.uk/eur/2016/679/article/9
1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
[Paragraph 2 lists the exceptions.]

UK GDPR - Article 13 (Information to be provided where personal data are collected from the data subject)
https://www.legislation.gov.uk/eur/2016/679/article/13
1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:
(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;
(b) the contact details of the data protection officer, where applicable;
(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;
(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;
(e) the recipients or categories of recipients of the personal data, if any;
[...]
2. In addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are obtained, provide the data subject with the following further information necessary to ensure fair and transparent processing:
(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;
(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;
[...]
(ca) the right to make a complaint to the controller under section 164A of the 2018 Act;
(d) the right to make a complaint to the Commission under section 165 of the 2018 Act;
[...]
(f) the existence of automated decision-making, including profiling, which is subject to the requirement to provide safeguards under Article 22C and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
3. Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information as referred to in paragraph 2.

UK GDPR - Article 22A(1) (Automated processing and significant decisions)
https://www.legislation.gov.uk/eur/2016/679/article/22A
1. For the purposes of Articles 22B and 22C—
(a) a decision is based solely on automated processing if there is no meaningful human involvement in the taking of the decision, and
(b) a decision is a significant decision, in relation to a data subject, if—
(i) it produces a legal effect for the data subject, or
(ii) it has a similarly significant effect for the data subject.
2. When considering whether there is meaningful human involvement in the taking of a decision, a person must consider, among other things, the extent to which the decision is reached by means of profiling.

UK GDPR - Article 22C (Safeguards for automated decision-making)
https://www.legislation.gov.uk/eur/2016/679/article/22C
1. Where a significant decision taken by or on behalf of a controller in relation to a data subject is—
(a) based entirely or partly on personal data, and
(b) based solely on automated processing,
the controller must ensure that safeguards for the data subject's rights, freedoms and legitimate interests are in place which comply with paragraph 2 and any regulations under Article 22D(3).
2. The safeguards must consist of or include measures which—
(a) provide the data subject with information about decisions described in paragraph 1 taken in relation to the data subject;
(b) enable the data subject to make representations about such decisions;
(c) enable the data subject to obtain human intervention on the part of the controller in relation to such decisions;
(d) enable the data subject to contest such decisions.

UK GDPR - Article 35 (Data protection impact assessment), paragraphs 1, 3(a) and 9
https://www.legislation.gov.uk/eur/2016/679/article/35
1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. [...]
3. A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:
(a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
[...]
9. Where appropriate, the controller shall seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations.

ICO - Employment practices and data protection: monitoring workers (version 1.0.0, 4 October 2023)
https://ico.org.uk/media/for-organisations/uk-gdpr-guidance-and-resources/employment-information/employment-practices-and-data-protection-monitoring-workers-1-0.pdf
Web version: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/monitoring-workers/
p. 15: "If, following your DPIA, you decide to go ahead with your proposed monitoring, you must provide information about it to your workers before you begin monitoring."
p. 17: "You can only change your purpose for monitoring if: your new purpose is compatible with your original purpose; you get consent; or you have a clear obligation or function set out in law."
p. 18: "You must not keep personal information obtained from monitoring workers for any longer than is necessary for your particular purpose or purposes." "You should not retain information just in case you find a purpose for it in the future."
p. 19: "You must also tell workers when you introduce changes."
pp. 19-20: "If you are planning to introduce monitoring, you should seek and document the views of your workers or their representatives (such as trade unions), unless there is a good reason not to."