Automated Decision-Making in UK SMEs: Operational Compliance Challenges under Article 22 UK GDPR

This paper examines how small and medium-sized enterprises (SMEs) in the United Kingdom encounter automated decision-making and profiling through routine business software such as payroll, recruitment, and payment systems. Using qualitative regulatory analysis and practitioner observation, it evaluates the operational application of Article 22 of the UK GDPR and identifies compliance gaps created by vendor opacity, limited audit visibility, and the absence of structured human review processes. The paper proposes proportionate compliance tools, vendor accountability expectations, and practical review procedures to improve transparency, accountability, and protection of data subject rights.