<head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>ADM Compliance Decision Tree</title> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Libre+Franklin:wght@300;700&display=swap" rel="stylesheet"> <style> :root{ --ink:#435A6A;--ink-soft:#5a7080;--line:#dfe4e8;--paper:#F6F8F9;--card:#ffffff; --brand:#E21152;--brand-dark:#435A6A; --go:#47d5cd;--go-bg:#e9f9f7;--go-line:#bfeae5; --warn:#fed100;--warn-bg:#fff8d4;--warn-line:#f3e08a; --stop:#fb4f14;--stop-bg:#ffe9e1;--stop-line:#fbc8b4; --neutral:#435A6A;--neutral-bg:#eef1f3;--neutral-line:#d4dbe0; --radius:10px;--shadow:none; } *{box-sizing:border-box} html{scroll-behavior:smooth} body{margin:0;min-height:100vh;font-family:'Libre Franklin',Helvetica,Arial,sans-serif;font-weight:300;color:var(--ink);background:var(--paper);line-height:1.6;-webkit-font-smoothing:antialiased} b,strong,.bold{font-weight:700} .wrap{max-width:760px;margin:0 auto;padding:32px 20px 80px;width:100%} .wide{max-width:920px} header.hero{margin-bottom:24px} .eyebrow{letter-spacing:.18em;text-transform:uppercase;font-size:11px;font-weight:700;color:var(--brand);margin-bottom:8px} h1{font-size:28px;line-height:1.25;margin:0 0 8px;color:var(--brand-dark);font-weight:300} .lede{font-size:15px;color:var(--ink-soft);max-width:600px} .modebar{display:flex;gap:0;margin:24px 0 8px;background:#e8ecef;border-radius:6px;padding:3px;width:max-content} .modebar button{font:inherit;font-size:13px;font-weight:700;border:none;cursor:pointer;padding:9px 22px;border-radius:5px;background:transparent;color:var(--ink-soft);transition:.15s} .modebar button.active{background:#fff;color:var(--brand);box-shadow:0 1px 3px rgba(0,0,0,.08)} .submode{font-size:12px;color:var(--ink-soft);margin:0 0 20px} .legend{display:flex;flex-wrap:wrap;gap:8px 18px;font-size:12px;color:var(--ink-soft);margin:0 0 24px} .key{display:flex;align-items:center;gap:6px} .dot{width:11px;height:11px;border-radius:3px} .dot.go{background:var(--go)}.dot.warn{background:var(--warn)}.dot.stop{background:var(--stop)}.dot.neutral{background:var(--neutral)} #wizard .progress{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--brand);text-align:center;margin-bottom:8px} .bar{height:4px;border-radius:99px;background:#dfe4e8;overflow:hidden;margin-bottom:20px} .bar i{display:block;height:100%;background:var(--brand);border-radius:99px;transition:width .35s} .qcard{background:var(--card);border:1px solid var(--line);border-radius:var(--radius);padding:28px 28px 24px;animation:rise .3s ease} @keyframes rise{from{opacity:0;transform:translateY(6px)}to{opacity:1;transform:none}} .qtag{font-size:10px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand);margin-bottom:6px} .q{font-size:21px;font-weight:300;line-height:1.35;margin:0 0 10px;color:var(--brand-dark)} .guide{font-size:14.5px;color:var(--ink-soft);margin:0 0 6px} details.ex{margin:10px 0 4px;border-top:1px solid var(--line);padding-top:10px} details.ex summary{font-size:12.5px;font-weight:700;color:var(--brand);cursor:pointer;list-style:none} details.ex summary::-webkit-details-marker{display:none} details.ex summary::before{content:"\25B8 "} details.ex[open] summary::before{content:"\25BE "} details.ex .body{font-size:13.5px;color:var(--ink-soft);padding:8px 0 0} details.ex .body p{margin:0 0 8px} details.ex .body ul{margin:4px 0 8px;padding-left:18px} .eg{background:#fff;border-left:3px solid var(--brand);border-radius:4px;padding:8px 12px;margin:8px 0;font-style:italic;color:var(--ink-soft);font-size:13px} .choices{display:flex;flex-direction:column;gap:8px;margin-top:16px} .choice{font:inherit;font-size:14px;font-weight:700;text-align:left;cursor:pointer;border:1px solid var(--line);background:#fff;border-radius:8px;padding:12px 16px;color:var(--ink);display:flex;align-items:center;gap:12px;transition:.15s} .choice:hover{border-color:var(--brand);background:#fef5f8} .choice .pill{flex:0 0 auto;font-size:11px;font-weight:700;letter-spacing:.04em;text-transform:uppercase;padding:3px 10px;border-radius:999px} .pill.yes{background:rgba(146,212,0,.6);color:#1d3b00}.pill.no{background:#fce8ef;color:var(--brand)}.pill.alt{background:#fdf6e3;color:var(--warn)} .choice .ctext{font-weight:300;color:var(--ink-soft);font-size:13px} .nav{display:flex;justify-content:space-between;align-items:center;margin-top:16px} .nav button{font:inherit;font-size:13px;font-weight:700;border:1px solid var(--line);background:#fff;color:var(--brand-dark);border-radius:6px;padding:8px 16px;cursor:pointer;transition:.15s} .nav button:hover{border-color:var(--brand);color:var(--brand)} .nav button[disabled]{opacity:.35;cursor:not-allowed} .trail{display:flex;flex-wrap:wrap;gap:5px;margin-top:14px} .crumb{font-size:11px;color:var(--brand-dark);background:#e8ecef;border:none;border-radius:4px;padding:4px 9px;cursor:pointer;font-weight:700} .crumb:hover{background:#dfe4e8} .crumb b{color:var(--brand)} .result{border-radius:var(--radius);padding:24px;animation:rise .3s ease;border:1px solid} .result.go{background:var(--go-bg);border-color:var(--go-line)} .result.warn{background:var(--warn-bg);border-color:var(--warn-line)} .result.stop{background:var(--stop-bg);border-color:var(--stop-line)} .result.neutral{background:var(--neutral-bg);border-color:var(--neutral-line)} .rtag{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;padding:4px 11px;border-radius:4px;color:#fff;margin-bottom:12px} .result.go .rtag{background:var(--go);color:#073b37}.result.warn .rtag{background:var(--warn);color:#4a3b00}.result.stop .rtag{background:var(--stop)}.result.neutral .rtag{background:var(--neutral)} .rhead{font-size:19px;font-weight:700;margin:0 0 8px;color:var(--brand-dark)} .rbody{font-size:14.5px;color:var(--ink-soft)} .rbody ul{padding-left:18px;margin:8px 0} .result .cont{margin-top:16px} .result .cont button{font-size:13px;font-weight:700;cursor:pointer;border:none;border-radius:6px;padding:10px 18px;background:var(--brand);color:#fff;transition:.15s} .result .cont button:hover{background:#c50e46} .result .cont button.ghost{background:transparent;color:var(--brand-dark);border:1px solid var(--line);margin-left:8px} #map{display:none} .flow{position:relative;padding-left:6px} .flow::before{content:"";position:absolute;left:28px;top:14px;bottom:30px;width:2px;background:var(--line)} .step{position:relative;margin:0 0 24px} .num{position:absolute;left:6px;top:20px;width:44px;height:44px;border-radius:50%;background:var(--brand);color:#fff;display:flex;align-items:center;justify-content:center;font-weight:700;font-size:14px;border:3px solid var(--paper);z-index:2} .mcard{margin-left:66px;background:var(--card);border:1px solid var(--line);border-radius:var(--radius);overflow:hidden} .mhead{padding:16px 20px 4px} .mq{font-size:17px;font-weight:300;margin:6px 0 8px;line-height:1.35;color:var(--brand-dark)} .branches{display:flex;flex-wrap:wrap;border-top:1px solid var(--line)} .branch{flex:1 1 50%;min-width:220px;padding:12px 16px} .branch+.branch{border-left:1px solid var(--line)} .ans{display:inline-block;font-size:11px;font-weight:700;letter-spacing:.04em;text-transform:uppercase;padding:3px 9px;border-radius:999px;margin-bottom:6px} .ans.yes{background:rgba(146,212,0,.6);color:#1d3b00}.ans.no{background:#fce8ef;color:var(--brand)}.ans.alt{background:#fdf6e3;color:var(--warn)} .out{font-size:13px;color:var(--ink-soft);line-height:1.45} .goto{color:var(--brand);font-weight:700;cursor:pointer;border-bottom:1px solid var(--brand)} .branch.go{background:var(--go-bg)}.branch.warn{background:var(--warn-bg)}.branch.stop{background:var(--stop-bg)}.branch.neutral{background:var(--neutral-bg)} .tag{display:inline-block;font-size:10px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;padding:2px 7px;border-radius:4px;margin-bottom:5px;color:#fff} .tag.go{background:var(--go);color:#073b37}.tag.warn{background:var(--warn);color:#4a3b00}.tag.stop{background:var(--stop)}.tag.neutral{background:var(--neutral)} .step:target .mcard{outline:2px solid var(--brand);outline-offset:2px} footer.ft{margin-top:40px;text-align:center;font-size:11px;color:#8a99a5;line-height:1.6;border-top:1px solid var(--line);padding-top:20px} footer.ft .t{color:var(--brand);font-size:11px;font-weight:700;margin-bottom:4px} @media(max-width:560px){.branch{flex:1 1 100%}.branch+.branch{border-left:none;border-top:1px solid var(--line)}h1{font-size:23px}.q{font-size:18px}} </style> </head> <body> <div class="wrap" id="shell"> <header class="hero"> <h1>Automated Decision-Making in HR</h1> <p class="lede">Work out whether the automated decision-making (ADM) provisions apply to your processing, and how to comply if they do.</p> </header> <div class="modebar"> <button id="btnWizard" class="active" onclick="setMode('wizard')">Step-by-step</button><button id="btnMap" onclick="setMode('map')">Full map</button> </div> <p class="submode" id="subWizard">Answer one question at a time, so you'll only see what's relevant to you.</p> <p class="submode" id="subMap" style="display:none">The whole decision tree on one page. Open "Examples &amp; detail" on any step.</p> <div class="legend"> <div class="key"><span class="dot go"></span><span>Proceed / compliant</span></div> <div class="key"><span class="dot warn"></span><span>Caution</span></div> <div class="key"><span class="dot stop"></span><span>Prohibited / non-compliant</span></div> <div class="key"><span class="dot neutral"></span><span>Provisions don't apply</span></div> </div> <section id="wizard"> <div class="progress" id="prog">Step 1</div> <div class="bar"><i id="barFill" style="width:6%"></i></div> <div id="stage"></div> <div class="trail" id="trail"></div> </section> <section id="map"></section> <footer class="ft"> <div class="t">Flowchart: using automated decision-making in HR &middot; a step-by-step guide to complying with the UK GDPR</div> <div>This tool summarises the ADM provisions for HR contexts and is not legal advice. Always check Schedule 1 to the Data Protection Act 2018, ICO guidance and the underlying legislation, and take advice on your circumstances.</div> </footer> </div> <script> const N={ q1:{n:'1',label:'Question 1',q:'Are you using personal data?',guide:'You are using personal data if information about an individual is in the <b>inputs</b> or the <b>outputs</b> of the tool. The ADM provisions can apply whether the information is all personal data or only partly personal data.',ex:'<div class="eg"><b>Inputs:</b> a candidate\'s CV is fed into an automated tool.</div><div class="eg"><b>Outputs:</b> you rely on an automated assessment to sift candidates for the next stage of recruitment.</div>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q2'},{k:'no',t:'No',sub:'Stop here',out:{tone:'neutral',tag:"Provisions don't apply",head:"The ADM provisions don't apply",body:"The ADM provisions don't apply to your processing."}}]}, q2:{n:'2',label:'Question 2',q:'Is your processing caught by the UK GDPR?',guide:'Establishment in the UK, or processing about UK staff, will usually bring you within scope, even if the data is used elsewhere.',ex:'<div class="eg">Your business is established in the UK \u2192 caught by the UK GDPR.</div><div class="eg">Your UK employees are managed from a New York office \u2192 information about UK staff still falls within the UK GDPR, even if only used by managers in New York.</div>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q3'},{k:'no',t:'No',sub:"Doesn't apply",out:{tone:'neutral',tag:"Provisions don't apply",head:"The ADM provisions don't apply here",body:'But <b>check whether your own jurisdiction regulates automated decision-making.</b>'}}]}, q3:{n:'3',label:'Question 3',q:'Is your processing <em>also</em> caught by the EU GDPR?',guide:'Either answer continues to the next step, but if the EU GDPR applies, you have an extra obligation.',ex:'<div class="eg">Your UK office is managed by your HQ in Paris \u2192 the EU GDPR is likely to be engaged.</div>',choices:[{k:'yes',t:'Yes',sub:'Extra step, then continue',next:'q3a',note:{tone:'warn',tag:'Extra step',text:'<b>Apply the EU GDPR standard.</b> Get in touch with your EU office to ensure you comply with the applicable rules, then continue.'}},{k:'no',t:'No',sub:'Continue',next:'q3a'}]}, q3a:{n:'3a',label:'Question 3a',q:'Are you making a decision about an individual?',guide:'A <b>decision</b> is an outcome or conclusion reflecting analysis that might <i>influence actions taken</i> or <i>affect an individual\'s rights</i>. It is different from simply applying a rule a human has set.',ex:'<div class="eg"><b>Not a decision (a rule):</b> a tool rejects applicants under 18; it just applies a rule a human set.</div><div class="eg"><b>Is a decision:</b> an AI tool judges whether a candidate seems reliable from facial expressions and tone in an AI-graded interview, and concludes they are not reliable enough.</div>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q4'},{k:'no',t:'No',sub:"Doesn't apply",out:{tone:'neutral',tag:"Provisions don't apply",head:"The ADM provisions don't apply",body:'<b>Keep a record of why</b> (it protects you if challenged). Still meet other UK GDPR duties: a DPIA where required, and lawfulness, fairness &amp; transparency.'}}]}, q4:{n:'4',label:'Question 4',q:'Is your decision-making <em>solely</em> automated?',guide:'I.e. is there <b>no meaningful human involvement</b>? Consider how far the decision is based on <b>profiling</b>, using automated means to analyse or predict a person\'s performance at work.',ex:'<div class="eg"><b>Profiling:</b> a tool that picks out "high fliers" among junior staff by evaluating drive, ambition and qualities.</div><p>Genuine human involvement means the human must: assess and review the decision; be able to influence the outcome; be appropriately trained; and take into account the relevant data and factors.</p>',choices:[{k:'yes',t:'Yes, fully automated',sub:'Continue',next:'q5'},{k:'alt',t:'Partly, but the human just rubber-stamps it',sub:'You may still be caught \u2192 continue',next:'q5',note:{tone:'warn',tag:'Caution',text:'Rubber-stamping is not meaningful human involvement, so you may still be caught by the ADM provisions. Treat it as solely automated and continue.'}},{k:'no',t:'No, robust independent human review',sub:"Doesn't apply",out:{tone:'neutral',tag:"Provisions don't apply",head:'Genuine human review takes you outside the ADM provisions',body:"If the human review is genuinely robust and independent, the ADM provisions won't apply. <b>Keep a record of why</b>, and still meet other UK GDPR duties (DPIA; lawfulness, fairness &amp; transparency)."}}]}, q5:{n:'5',label:'Question 5',q:'Does the decision produce <em>legal effects</em> for the data subject?',guide:'A legal effect changes a person\'s legal rights or legal status.',ex:'<div class="eg">The decision results in the termination of an employee\'s contract of employment.</div>',choices:[{k:'yes',t:'Yes',sub:'Skip to Q7',next:'q7'},{k:'no',t:'No',sub:'Check the next test',next:'q6'}]}, q6:{n:'6',label:'Question 6',q:'Does the decision produce a <em>similarly significant effect</em>?',guide:'An effect equivalent to a legal effect: an impact on a person\'s opportunities, behaviour, circumstances or choices.',ex:'<div class="eg">The decision makes an employee ineligible for promotion.</div>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q7'},{k:'no',t:'No',sub:"Doesn't apply",out:{tone:'neutral',tag:"Provisions don't apply",head:"The ADM provisions don't apply",body:'<b>Keep a record of why.</b> Still meet other UK GDPR duties (DPIA; lawfulness, fairness &amp; transparency).'}}]}, q7:{n:'7',label:'Question 7',q:'Is the decision carried out wholly or partly in reliance on Article 6(1)(ea) (recognised legitimate interests)?',guide:'This is <b>unlikely</b> in HR. Recognised legitimate interests only apply where a private body processes personal data in an emergency, such as detecting crime or apprehending offenders.',choices:[{k:'yes',t:'Yes',sub:'Caution: check the basis',next:'q7a',note:{tone:'stop',tag:'Caution',text:'If you really are relying on Art 6(1)(ea), your processing is <b>not permitted</b> under the ADM provisions. Check whether this basis is genuinely relevant; if not, a different basis may let you use ADM.'}},{k:'no',t:'No',sub:'Continue',next:'q8'}]}, q7a:{n:'7a',label:'Question 7a',q:'Can you meet a legal basis <em>other than</em> Article 6(1)(ea)?',guide:'For example contract, public task or legitimate interests. <b>Consent is not appropriate in HR</b> (power imbalance). Each basis requires the processing to be <b>"necessary"</b>: a targeted, proportionate way of meeting your objective.',ex:'<div class="eg">A tool scoring productivity from continuous monitoring of work phones and laptops is unlikely to be "necessary"; a less intrusive method would likely achieve the same purpose.</div>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q8'},{k:'no',t:'No',sub:'Prohibited',out:{tone:'stop',tag:'Prohibited',head:'Your processing is not lawful',body:'It is prohibited under the UK GDPR. You may be able to satisfy lawfulness by modifying how the tool works. Consider this carefully and record your analysis in a DPIA.'}}]}, q8:{n:'8',label:'Question 8',q:'Is the decision based solely or partly on <em>special category</em> personal data?',guide:'Special category data is more sensitive and triggers extra conditions.',ex:'<p><b>Special category data:</b> racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (for identification); health; sex life; sexual orientation.</p>',choices:[{k:'yes',t:'Yes',sub:'Extra conditions apply',next:'q9'},{k:'no',t:'No',sub:'Skip to safeguards (Q13)',next:'q13'}]}, q9:{n:'9',label:'Question 9',q:'Is the solely automated decision <em>necessary for a contract</em> with the data subject?',guide:'I.e. necessary for entering into or performing a contract. <b>"Necessary"</b> means targeted and proportionate. <b>Do not seek explicit consent in HR</b> (power imbalance).',ex:'<div class="eg">An airline uses ADM to reduce a huge pool of pilot applicants, including a medical screening test to ensure fitness for the job.</div>',choices:[{k:'yes',t:'Yes',sub:'You have a route \u2192 Q13',next:'q13'},{k:'no',t:'No',sub:'Check the next condition',next:'q10'}]}, q10:{n:'10',label:'Question 10',q:'Is the solely automated decision <em>required or authorised by law</em>?',guide:'You must point to a statutory or common law power. It need not mention automated decision-making explicitly for you to rely on it.',ex:'<div class="eg">A system monitoring the health and alertness of staff on dangerous machinery may rely on employment legislation or a common law duty of care (it must also be proportionate).</div>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q11'},{k:'no',t:'No',sub:'Prohibited',out:{tone:'stop',tag:'Prohibited',head:'Special category data cannot be used',body:'The use of special category personal data is prohibited under the ADM provisions.'}}]}, q11:{n:'11',label:'Question 11',q:'Does the processing meet a condition in Article 9(2)(g)?',guide:'Substantial public interest, set out in Part 2 of Schedule 1 to the Data Protection Act 2018. The "necessary" test applies throughout.',ex:'<p><b>Para 6, Statutory &amp; government purposes:</b> discharging obligations under statute or a rule of law (e.g. health &amp; safety) where necessary for substantial public interest.</p><p><b>Para 8, Equality of treatment/opportunity:</b> must compare groups with different characteristics; it cannot support decisions about a particular individual.</p><p><b>Para 9, Racial &amp; ethnic diversity at senior levels:</b> with safeguards, as part of identifying suitable individuals for senior positions.</p><p><b>Not exhaustive</b>: check Schedule 1 and guidance for another condition.</p>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q12'},{k:'no',t:'No',sub:'Prohibited',out:{tone:'stop',tag:'Prohibited',head:'Special category data cannot be used',body:'You cannot use special category personal data for ADM.'}}]}, q12:{n:'12',label:'Question 12',q:'Do you have an <em>appropriate policy document</em> in place?',guide:'Most substantial-public-interest conditions in Schedule 1 require one before you can rely on the condition.',ex:'<p>The document must briefly outline: the Schedule 1 condition relied on; your procedures for complying with each data protection principle; your retention and deletion policies; and an indication of the retention period for the specific data.</p>',choices:[{k:'yes',t:'Yes',sub:'You can use special category data \u2192 Q12a',next:'q12a'},{k:'no',t:'No',sub:'Action needed',out:{tone:'warn',tag:'Action needed',head:'Put an appropriate policy document in place',body:"You can do this easily to enable the processing. <b>If you don't, special category data cannot be used for ADM.</b> Once it's in place, return and continue to Q12a."}}]}, q12a:{n:'12a',label:'Question 12a',q:'Can you satisfy a relevant Article 9 condition for the special category data?',guide:'In addition to an Article 6 basis, special category data needs an <b>Article 9</b> condition and, where relevant, a <b>Schedule 1</b> condition. You can usually refer back to steps 8 to 12, but <b>document your Article 9 condition</b>, as it is a separate legal requirement.',choices:[{k:'yes',t:'Yes',sub:'Continue to safeguards',next:'q13'},{k:'no',t:'No',sub:'Prohibited',out:{tone:'stop',tag:'Prohibited',head:'Your processing is not lawful',body:'It is prohibited under the UK GDPR. You may satisfy lawfulness by modifying the tool. Consider carefully and record in a DPIA.'}}]}, q13:{n:'13',label:'Question 13 \u00B7 Safeguards begin',q:'Have you given people information about your use of ADM as it relates to them?',guide:'You must <b>understand</b> how the decision was made and <b>explain</b> it, in enough detail that the person can decide whether to exercise their rights.',ex:'<p><b>Understand it:</b> know the underlying rules and influencing factors, keep an audit trail of key decision points, verify results, and explain how the decision was reached where there were alternatives.</p><p><b>Tell people how it was made:</b> the factors that contributed; whether you used profiling; whether it was influenced by data from another controller. You cannot just rely on your privacy notice.</p><p><b>Tell people how to challenge it</b> at the time the decision is communicated.</p>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q14'},{k:'no',t:'No',sub:'Non-compliant',out:{tone:'stop',tag:'Non-compliant',head:'Not compliant with the ADM provisions',body:'Your organisation could face regulatory action, claims and/or reputational damage. Put this information in place so you can lawfully use ADM.'}}]}, q14:{n:'14',label:'Question 14',q:'Is the data subject able to <em>make representations</em> about the decision?',guide:'Explain that they have this right and help them use it easily and quickly. They are entitled to set out their view and provide additional information not previously taken into account.',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q15'},{k:'no',t:'No',sub:'Non-compliant',out:{tone:'stop',tag:'Non-compliant',head:'Not compliant with the ADM provisions',body:'Risk of regulatory action, claims and/or reputational damage. Enable representations so you can lawfully use ADM.'}}]}, q15:{n:'15',label:'Question 15',q:'Do you enable the data subject to obtain <em>human intervention</em>?',guide:'People must be able to have the decision reconsidered by a human who can change it.',ex:'<p>The reviewer must be suitably qualified and trained, understand the system and its risks (bias/discrimination), have the information the system used, consider further information from the data subject, and be empowered to alter or overturn the decision. Keep records and monitor performance; many overturned decisions may mean the system is unreliable.</p>',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q16'},{k:'no',t:'No',sub:'Non-compliant',out:{tone:'stop',tag:'Non-compliant',head:'Not compliant with the ADM provisions',body:'Risk of regulatory action, claims and/or reputational damage. Put a human-review process in place so you can lawfully use ADM.'}}]}, q16:{n:'16',label:'Question 16',q:'Do you enable the data subject to <em>contest</em> the automated decision?',guide:'Tell people they can contest the decision and how, and implement procedures to enable it. Build the relevant timeframes (Q17) into your process.',choices:[{k:'yes',t:'Yes',sub:'Continue',next:'q17'},{k:'no',t:'No',sub:'Non-compliant',out:{tone:'stop',tag:'Non-compliant',head:'Not compliant with the ADM provisions',body:'Risk of regulatory action, claims and/or reputational damage. Enable contesting so you can lawfully use ADM.'}}]}, q17:{n:'17',label:'Question 17',q:'Are you complying with the relevant <em>time periods</em>?',guide:'When people make representations, request human intervention, or contest decisions, you must act <b>without undue delay and within one month</b> of receipt (extendable by up to two further months in certain circumstances).',ex:'<p>Several rights are often exercised over the same decision. Failure to act within the limits can lead to regulatory action, including reprimands or fines.</p>',choices:[{k:'yes',t:'Yes',sub:'Final check',next:'q18'},{k:'no',t:'No',sub:'Action needed \u2192 then continue',next:'q18',note:{tone:'warn',tag:'Action needed',text:'Put policies and procedures in place so you can meet the prescribed time limits, then continue to the final check.'}}]}, q18:{n:'18',label:'Question 18 \u00B7 Final check',q:'Is your processing generally compliant with the UK GDPR?',guide:'You cannot rely on the ADM provisions or the legal-basis rules alone. Using ADM tools in HR is <b>high risk</b>.',ex:'<p>You will also need to: complete a data protection impact assessment (DPIA); and ensure your processing is fair and transparent.</p>',choices:[{k:'yes',t:'Yes, and my DPIA is done',sub:'You can use ADM',out:{tone:'go',tag:'Compliant',head:'You can use ADM',body:'Provided you have completed a DPIA and your processing is fair and transparent. Keep your records and monitor the system on an ongoing basis.'}},{k:'no',t:'Not yet',sub:'More to do',out:{tone:'warn',tag:'Not yet',head:'Almost there: finish the groundwork',body:'Complete a DPIA and make sure your processing is fair and transparent before relying on ADM. Using ADM in HR is high risk.'}}]} }; const ORDER=Object.keys(N); let stack=['q1'],pendingNote=null; function curId(){return stack[stack.length-1]} function render(){ const id=curId(); if(id.startsWith('OUT:')){renderResult(JSON.parse(id.slice(4)));return;} const node=N[id],idx=ORDER.indexOf(id)+1; document.getElementById('prog').textContent='Step '+idx+' of '+ORDER.length; document.getElementById('barFill').style.width=Math.round(idx/ORDER.length*100)+'%'; let noteHtml=pendingNote?`<div class="result ${pendingNote.tone}" style="padding:12px 14px;margin:0 0 14px"><span class="rtag">${pendingNote.tag}</span><div class="rbody" style="font-size:13.5px">${pendingNote.text}</div></div>`:''; pendingNote=null; let choices=node.choices.map((c,i)=>{const dup=c.t.trim()==='Yes'||c.t.trim()==='No';const head=dup?'':`<span style="display:block">${c.t}</span>`;return `<button class="choice" onclick="choose(${i})"><span class="pill ${c.k}">${c.k==='alt'?'Maybe':c.k}</span><span>${head}<span class="ctext">${c.sub||''}</span></span></button>`;}).join(''); document.getElementById('stage').innerHTML=`${noteHtml}<div class="qcard"><div class="qtag">${node.label}</div><div class="q">${node.q}</div><p class="guide">${node.guide}</p>${node.ex?`<details class="ex"><summary>Examples &amp; detail</summary><div class="body">${node.ex}</div></details>`:''}<div class="choices">${choices}</div><div class="nav"><button onclick="back()" ${stack.length<2?'disabled':''}>\u2190 Back</button><button onclick="restart()">Start over</button></div></div>`; renderTrail(); } function choose(i){const node=N[curId()],c=node.choices[i];node._chosen=c.t;if(c.note)pendingNote=c.note;if(c.out)stack.push('OUT:'+JSON.stringify(c.out));else stack.push(c.next);render();} function back(){if(stack.length>1){stack.pop();pendingNote=null;render();}} function restart(){stack=['q1'];pendingNote=null;render();} function renderResult(out){ document.getElementById('prog').textContent='Outcome'; document.getElementById('barFill').style.width='100%'; document.getElementById('stage').innerHTML=`<div class="result ${out.tone}"><span class="rtag">${out.tag}</span><div class="rhead">${out.head}</div><div class="rbody">${out.body}</div><div class="cont"><button onclick="back()">\u2190 Change my answer</button><button class="ghost" onclick="restart()">Start over</button></div></div>`; renderTrail(); } function renderTrail(){ const t=document.getElementById('trail'),items=stack.filter(s=>!s.startsWith('OUT:')); if(items.length<2){t.innerHTML='';return;} t.innerHTML=items.slice(0,-1).map((id,i)=>{const node=N[id];return`<button class="crumb" onclick="jump(${i+1})">${node.label.replace('Question','Q').split('\u00B7')[0].trim()}: <b>${node._chosen||''}</b></button>`;}).join(''); } function jump(len){stack=stack.slice(0,len);pendingNote=null;render();} function buildMap(){ let html='<div class="flow">'; ORDER.forEach(id=>{ const node=N[id]; const branches=node.choices.map(c=>{ const tone=c.out?c.out.tone:(c.note?c.note.tone:''); const ansClass=c.k==='alt'?'alt':c.k; let body; if(c.out)body=`<span class="tag ${c.out.tone}">${c.out.tag}</span><br>${c.out.head}. ${c.out.body}`; else{const tgt=N[c.next];body=`${c.sub||'Continue'} \u00B7 <span class="goto" onclick="mapJump('${c.next}')">Go to ${tgt.label.replace('Question','Q').split('\u00B7')[0].trim()}</span>`;if(c.note)body=`<span class="tag ${c.note.tone}">${c.note.tag}</span><br>${c.note.text}<br>${body}`;} return`<div class="branch ${tone}"><span class="ans ${ansClass}">${c.t}</span><div class="out">${body}</div></div>`; }).join(''); html+=`<div class="step" id="m-${id}"><div class="num">${node.n}</div><div class="mcard"><div class="mhead"><div class="qtag">${node.label}</div><div class="mq">${node.q}</div><p class="guide" style="font-size:13.5px">${node.guide}</p>${node.ex?`<details class="ex"><summary>Examples &amp; detail</summary><div class="body">${node.ex}</div></details>`:''}</div><div class="branches">${branches}</div></div></div>`; }); html+='</div>'; document.getElementById('map').innerHTML=html; } function mapJump(id){const el=document.getElementById('m-'+id);if(el)el.scrollIntoView({behavior:'smooth',block:'center'});} function setMode(m){ const wiz=document.getElementById('wizard'),map=document.getElementById('map'),bw=document.getElementById('btnWizard'),bm=document.getElementById('btnMap'),shell=document.getElementById('shell'); if(m==='map'){wiz.style.display='none';map.style.display='block';bm.classList.add('active');bw.classList.remove('active');document.getElementById('subWizard').style.display='none';document.getElementById('subMap').style.display='block';shell.classList.add('wide');} else{map.style.display='none';wiz.style.display='block';bw.classList.add('active');bm.classList.remove('active');document.getElementById('subWizard').style.display='block';document.getElementById('subMap').style.display='none';shell.classList.remove('wide');} } buildMap(); render(); </script> <script> (function(){ function fit(){ if(window.frameElement){ window.frameElement.style.height=document.documentElement.scrollHeight+'px'; } } window.addEventListener('load',fit); window.addEventListener('resize',fit); if(window.ResizeObserver){ try{ new ResizeObserver(fit).observe(document.documentElement); }catch(e){} } document.addEventListener('click',function(){ setTimeout(fit,60); }); setTimeout(fit,300); })(); </script> </body> </html> ">