Automated lending decisions carry some of the clearest legal effects in UK data protection law
Creditworthiness, affordability and pricing decisions are textbook examples of decisions producing a "legal or similarly significant effect" under Article 22A. Lenders and credit brokers need a defensible, evidence-backed record of every automated decision point in the lending journey — one that satisfies both the ICO and the FCA's Consumer Duty expectations.
Two regulators, one set of automated decisions
Lending sits at the intersection of UK GDPR ADM rules and the FCA's existing regulatory framework. The FCA has confirmed it will not introduce AI-specific rules for financial services, relying instead on the Consumer Duty, the Senior Managers and Certification Regime, and existing governance expectations to govern AI use — meaning firms must demonstrate fair outcomes from automated decisions using their existing accountability structures. The FCA has separately said it will produce a code of practice for AI in automated decision-making, adding a further layer firms will need to track.
Automated affordability checks, credit-scoring models, and fraud-flagging systems that lead to an application being declined without meaningful human review are strong candidates for Article 22A classification. Special-category data risk is real here too: affordability assessments can draw on data that indirectly reveals health conditions or disability-related income sources, triggering the stricter Article 22B regime.
A digital-only lender processing 4,000 applications a month
A lender's affordability engine auto-declines around a third of applications with no human review step. The credit team has never assessed whether the auto-decline function is ADM, and cannot produce a lawful-basis record for the underlying scoring model. Illustrative example — not a real client or verified statistic.
Auto-decline logic runs unreviewed; no lawful-basis or DPIA record exists for the scoring model.
Every automated lending decision point is classified, risk-scored, and backed by a documented lawful basis and DPIA.
Where to start
- Classify every automated affordability, credit-scoring and fraud-flagging decision against Article 22A.
- Confirm the Article 6 lawful basis for each model and rule out reliance on recognised legitimate interests.
- Assess whether scoring models draw on data capable of revealing special-category information, even indirectly.
- Align ADM documentation with existing Consumer Duty and SM&CR governance records rather than creating a parallel system.