GDPR Article 22 Automated Decision-Making and Profiling

Treat Article 22 as a focused scoping question, not as a label for every model, score, or recommendation. The decision must be based solely on automated processing, including profiling, and it must produce legal effects or similarly significant effects for the data subject.

Record the decision being made, the point in the journey where it occurs, whether a human can materially change the outcome before it affects the person, and the practical effect on access, eligibility, pricing, employment, services, or other rights and interests.

A controller still needs a GDPR lawful basis for the personal data processing. If the decision is inside Article 22, the controller also needs one of the Article 22 exceptions: necessary for entering into or performing a contract with the data subject, authorised by Union or Member State law with suitable safeguards, or based on the data subject's explicit consent.

Do not treat ordinary consent, generic terms acceptance, or a broad legitimate-interest assessment as enough for an Article 22 decision. For contract and explicit-consent routes, Article 22 requires suitable measures to protect the person's rights, freedoms, and legitimate interests.

Privacy notices and access responses need to say when Article 22 automated decision-making, including profiling, exists. At least in those cases, GDPR Articles 13, 14, and 15 call for meaningful information about the logic involved and the significance and envisaged consequences for the data subject.

Useful transparency is specific to the person-facing decision. Explain the decision purpose, the main categories of input data, the broad factors that influence the outcome, the consequences of the outcome, and the routes for human intervention, point-of-view submission, and contesting the decision.

For Article 22 decisions relying on contract necessity or explicit consent, the controller must implement suitable safeguards. GDPR identifies at least three: the right to obtain human intervention from the controller, to express a point of view, and to contest the decision.

A safeguard is not meaningful if the reviewer can only rubber-stamp the automated output. The review workflow should give a trained person enough context, authority, and time to change the result when the facts, data quality, or proportionality analysis support a different outcome.

GDPR Article 35 makes a DPIA mandatory for high-risk processing, including systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where decisions produce legal or similarly significant effects. DPIA guidance in the grounding materials treats automated decision-making and profiling as risk criteria that should be assessed early and revisited when the processing changes.

The DPIA record should connect the Article 22 analysis to necessity and proportionality, data minimisation, accuracy, retention, transparency, rights handling, security controls, processor involvement, and residual risk. If a prior DPIA is reused for similar processing, document why the nature, scope, context, and purposes remain sufficiently similar.

Evidence should let a reviewer reconstruct the decision system without relying on memory. Keep a single record that ties the automated decision, Article 22 conclusion, lawful route, transparency text, DPIA, safeguards, and contest outcomes together.

Evidence should also show what is not Article 22. Where a tool produces a score or recommendation but a human makes the effective decision, preserve proof that human review is real, documented, and able to change the outcome before it affects the person.