GDPR Article 22: Automated individual decision-making, including profiling

· By Bertrand BucelleBertrand Bucelle · 2 min read

GDPR Article 22: Automated individual decision-making, including profiling

Article 22 of the GDPR Explained

A data subject has the right to not be subject to a decision based solely on automated processing, including profiling, if that decision produces legal effects concerning them or similarly significantly affects them.

Exceptions exist:

  • If the decision is necessary for entering into, or the performance of, a contract;
  • If it is authorised by EU or Member State law;
  • If it is based on the data subject's explicit consent.

Even in these cases, additional safeguards are required (human intervention, possibility to express one's point of view, etc.).

Why This Article Matters for Your GDPR Compliance

Automated processing operations are becoming increasingly frequent (AI, scoring, recommendations). This right protects against unfair or opaque decisions and mandates transparency in algorithmic processes.

How to comply with Article 22 of the GDPR?

  • Identify all processing based on automated decision-making in your record.
  • Verify whether these decisions produce legal or significant effects.
  • Prepare procedures for challenge and human intervention.
  • Clearly inform data subjects of the existence of such processing and the associated rights.

Examples of Application of Article 22 of the GDPR

  • A bank loan is automatically refused based on an algorithm: the individual must be able to challenge the decision and obtain human review.
  • Recruitment relies on an automatic scoring tool: the candidate can request an explanation and present their arguments.
  • An insurance company sets its prices via a behavioural profiling tool: the user must be informed and be able to refuse such processing if it is exclusively automated.

Related Resources

Accelerate Your Compliance in a Few Clicks

Thanks to our all-in-one solution, you can accelerate and ensure your compliance easily:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Raise awareness among your teams with our GDPR training e-learning

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now