GDPR Article 22 Automated Decision-Making and Profiling

Article 22 covers only decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects for the data subject. It does not cover every model, score, or recommendation. A score produced by one organisation can itself be the Article 22 decision when a third party relies on it in a way that plays a determining role, as the Court of Justice held for credit scoring in Case C-634/21.

Record the decision being made, the point in the journey where it occurs, whether a human can materially change the outcome before it affects the person, and the practical effect on access, eligibility, pricing, employment, services, or other rights and interests.

Profiling outside Article 22 still needs an Article 6 lawful basis, compliance with the Article 5 principles, transparent information, and applicable rights handling. Under Article 21, a person can object on grounds relating to their situation to profiling based on public task or legitimate interests. The controller must stop unless it demonstrates compelling legitimate grounds that override the person's interests, rights, and freedoms or the processing is needed for legal claims. Profiling related to direct marketing must stop when the person objects to that marketing.

A controller still needs a GDPR lawful basis for the personal data processing. If the decision is inside Article 22, the controller also needs one of the Article 22 exceptions: necessary for entering into or performing a contract with the data subject, authorised by Union or Member State law with suitable safeguards, or based on the data subject's explicit consent.

Do not treat ordinary consent, generic terms acceptance, or a broad legitimate-interest assessment as enough for an Article 22 decision. For contract and explicit-consent routes, Article 22 requires suitable measures to protect the person's rights, freedoms, and legitimate interests. Article 22(4) adds a stricter rule for special-category data: the decision may not be based on Article 9 data unless Article 9(2)(a) explicit consent or Article 9(2)(g) substantial public interest applies and suitable safeguards are in place.

Privacy notices and access responses need to say when Article 22 automated decision-making, including profiling, exists. At least in those cases, GDPR Articles 13, 14, and 15 call for meaningful information about the logic involved and the significance and envisaged consequences for the data subject.

Useful transparency is specific to the person-facing decision. Explain the decision purpose, the main categories of input data, the broad factors that influence the outcome, the consequences of the outcome, and the routes for human intervention, point-of-view submission, and contesting the decision.

For Article 22 decisions relying on contract necessity or explicit consent, the controller must implement suitable safeguards. GDPR identifies at least three: the right to obtain human intervention from the controller, to express a point of view, and to contest the decision.

A safeguard is not meaningful if the reviewer can only rubber-stamp the automated output. The review workflow should give a trained person enough context, authority, and time to change the result when the facts, data quality, or proportionality analysis support a different outcome.

GDPR Article 35 makes a DPIA mandatory for high-risk processing, including systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where decisions produce legal or similarly significant effects. DPA guidance treats automated decision-making and profiling as risk criteria that should be assessed early and revisited when the processing changes.

The DPIA record should connect the Article 22 analysis to necessity and proportionality, data minimisation, accuracy, retention, transparency, rights handling, security controls, processor involvement, and residual risk. If a prior DPIA is reused for similar processing, document why the nature, scope, context, and purposes remain sufficiently similar.

Evidence should let a reviewer reconstruct the decision system without relying on memory. Keep a single record that ties the automated decision, Article 22 conclusion, lawful route, transparency text, DPIA, safeguards, and contest outcomes together.

Evidence should also show what is not Article 22. Where a tool produces a score or recommendation but a human makes the effective decision, preserve proof that human review is real, documented, and able to change the outcome before it affects the person.