GDPR Article 22: Automated Individual Decisions

Citation

European Parliament and Council. Regulation (EU) 2016/679, General Data Protection Regulation, Article 22. EUR-Lex. Accessed 2026-08-14.

Source type: legislation
Evidence quality: primary authority
Review status: checked; specialist legal review required

What it says

Article 22 addresses decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. It contains exceptions and safeguards. For specified contract- or consent-based exceptions, safeguards include the right to obtain human intervention, express a point of view, and contest the decision.

Assumptions and weaknesses

It is inaccurate to describe Article 22 as a universal ban on automation or a universal right to explanation. Whether platform enforcement is solely automated and sufficiently significant is fact- and jurisdiction-dependent, and other GDPR provisions may apply independently.

Implications for platform defense

Record whether automation recommended or made a decision, what meaningful human review occurred, and how a person can contest a consequential outcome. Avoid decorative human review that merely ratifies a score.

Chapters this affects

Chapters 5–7, 12, 15, 17, 18, and 21.