Infrastructure Briefings

The UK Quietly Changed the Rules on Automated Decisions. Here's What It Means for Events.

By Ed Richards,

New UK GDPR rules on automated decision making took effect this month. Most events businesses already have more of these decisions running than anyone has written down.

What actually happened on 5 February

Earlier this month, new sections of UK GDPR came into force under the Data (Use and Access) Act 2025. They replace the old Article 22, which was built around a fairly blunt idea: a decision made "solely" by automated means, with legal or similarly significant effect on someone, was restricted by default.

The new version is more permissive. It gives organisations more room to actually use automated decision making, provided certain safeguards are in place. This is not a crackdown. If anything it is the opposite: the door has opened a bit wider. What has changed is what you owe the person on the other end of the decision.

I am not a lawyer and this is not legal advice. The point of this post is not the fine print, it is the fact that most events businesses are already doing the thing the law is now talking about, and have not necessarily noticed.

Where automated decisions already live in an events business

Nobody in events tends to say "we use automated decision making." But look at what is actually running:

  • A CRM that scores inbound leads and quietly deprioritises the ones under a threshold, so a sales person never sees them.
  • A sponsorship or exhibitor application form that auto-declines anyone who does not meet a stated criterion, with no human looking at the borderline cases.
  • Dynamic pricing on ticketing that raises or drops a price band based on sales velocity, with nobody reviewing individual outcomes.
  • Registration screening that flags or blocks a delegate signup based on a rule set, sometimes with an AI layer added on top to catch duplicates or fraud.
  • A chatbot on the website that can say no to a refund request without a human ever reading the message.

None of these were built with Article 22 in mind. They were built to save someone an afternoon. That is exactly the pattern the new rules are aimed at.

A conference venue in the north west found this out the practical way. Its exhibitor application form had quietly auto-declined anyone who left one field blank, since the launch of the form two years earlier. Nobody had decided that on purpose. Someone had ticked "required field" in a form builder and moved on. The decisions it made were real, even though nobody had ever called them decisions.

What the safeguards actually mean in practice

Stripped of the legal language, the shift is roughly this: you get more freedom to automate, in exchange for three things people can rely on.

  • Being told it happened. Someone whose lead score, application, price or refund was shaped by an automated process should be able to find that out, not discover it by accident.
  • Being able to ask for a human. There needs to be a real route to a person, not a contact form that also gets triaged by the same system.
  • Being able to contest it. If the decision was wrong, there is a way to say so and have it looked at again by someone with the authority to change it.

A dynamic ticket price is a low-stakes example. An exhibitor application that gets auto-declined the week before a show, for a company that would have been a good fit, is not.

Why this is worth an hour now rather than later

Most of the automated decisions above were never signed off as automated decisions. They were a CRM feature someone switched on, a form logic someone built in an afternoon, a chatbot script someone wrote to stop the same refund question landing in the inbox forty times a week. Nobody sat in a meeting and decided "we are now making automated decisions with legal effect on people."

That is normal, and it is also exactly the gap the new rules are pointing at. The businesses that will find this easy are the ones who already know where their automated decisions sit. The ones who will find it uncomfortable are the ones who find out when someone asks, in writing, why they were declined.

A one-page exercise: where are our automated decisions

This does not need a compliance project. It needs a list. Paste the prompt below into your AI assistant along with a rough description of your CRM, your booking or ticketing system, your application forms and any chatbot or auto-reply tool, and ask it to help you build the first draft of the register. Expect back a simple table you can hand to whoever owns each system.

I run an events business (agency, venue or supplier, describe which). Help me build a one-page register of where we might already have automated decision making running, in the sense used by UK GDPR (a decision made by a system, with no meaningful human review, that affects a person's opportunities, price, access or outcome).

I will describe our systems below. For each one, tell me:
1. Whether it plausibly counts as an automated decision under this definition, and why.
2. What the likely effect on a person is (an opportunity lost, a price set, an access decision, a refusal).
3. Whether a human currently reviews individual outcomes, or only monitors the system in aggregate.
4. One practical question I should be able to answer if someone challenged this decision.

Do not give legal advice or quote specific article numbers. Keep this practical and specific to what I describe.

Our systems:
[describe your CRM lead scoring, application forms, ticketing or pricing tool, registration screening, and any chatbot or auto-reply system]

What to do with the answer

Once you have the list, the fix is rarely technical. Most of the time it is a line added to a form ("this application is assessed automatically against these criteria, you can ask for a human review"), a genuine route to a person for the chatbot, and someone named as the person who reviews a contested decision. None of that requires new software.

If you want a second pair of eyes on where this sits in your systems specifically, that is the kind of thing a Discovery Lab tends to surface early, usually in the first few conversations, well before anyone gets to the written report.

More insights