Automated decision-making is the process of making a decision about a person solely by technological means, without meaningful human involvement, often based on profiling. In data protection law and user rights, the term refers above all to Article 22 of the EU General Data Protection Regulation (GDPR), which gives individuals the right not to be subject to such decisions when they produce legal effects or similarly significant effects.
Typical examples are automatic loan refusals, algorithmic screening of job applications and automated insurance pricing. The rules do not ban algorithms; they limit fully automated decisions with serious consequences and require safeguards when such decisions are allowed.
What counts as automated decision-making under Article 22
Article 22 applies only when three conditions are met together. There must be a decision about an individual; it must be based solely on automated processing, including profiling; and it must produce legal effects or similarly significantly affect the person. If any element is missing, the specific Article 22 rules do not apply, although the general GDPR principles still do.
| Condition | Meaning | Example |
|---|---|---|
| Decision about an individual | An outcome concerning a specific person | Approving or rejecting a credit application |
| Solely automated | No meaningful human review of the outcome | A system rejects applicants below a score |
| Legal or similarly significant effect | Affects rights, finances, access or opportunities | Refused loan, job, benefit or contract |
The phrase solely automated is interpreted strictly. A human who merely rubber-stamps an algorithm’s output, without the authority or information to change it, does not make the decision less automated. Regulators expect meaningful human oversight: a reviewer who understands the case, can weigh other factors and can overturn the result.
The Court of Justice of the European Union has also held that a credit score calculated by a third party can itself be an automated decision when lenders rely on it decisively. This widened the practical scope of the rule beyond the final decision maker.
When such decisions are permitted
Article 22 sets a general prohibition with three exceptions. A solely automated decision with significant effects is allowed only when it is necessary for entering into or performing a contract, authorized by law with suitable safeguards, or based on the person’s explicit consent.
| Exception | Typical use | Required safeguards |
|---|---|---|
| Contract necessity | Instant online credit or insurance offers | Human intervention, right to contest |
| Authorization by law | Fraud or tax compliance checks | Safeguards defined by that law |
| Explicit consent | Optional automated services | Human intervention, right to contest |
Decisions based on special categories of data, such as health, ethnicity or religious beliefs, face stricter limits. They are allowed only with explicit consent or for reasons of substantial public interest, and only with suitable measures to protect the individual.
Rights of the individual
Where automated decisions are permitted, the person keeps a set of core safeguard rights. These rights turn a closed algorithmic process into one that can be questioned and corrected.
- Right to human intervention: a qualified person reviews the decision.
- Right to express a point of view: the individual can add context the system ignored.
- Right to contest the decision: the outcome can be challenged and changed.
- Right to meaningful information about the logic involved, its significance and envisaged consequences, given at collection and on request through the right of access.
These safeguards interact with other user rights. The right of access reveals that automated decisions take place, the right to rectification fixes wrong input data, and the right to object can stop profiling used for direct marketing entirely.
Automated decision-making compared with related concepts
Automated decision-making overlaps with, but differs from, profiling and AI regulation. Profiling evaluates personal aspects, such as reliability or preferences, and can happen without any decision; a decision can be automated without profiling, for example a speed camera fine based on a measured value.
| Concept | Focus | Relationship |
|---|---|---|
| Automated decision-making | Outcome decided without human involvement | Regulated by Article 22 when significant |
| Profiling | Evaluation of personal characteristics | Often feeds automated decisions |
| Decision support | Algorithm advises, human decides | Outside Article 22 if review is meaningful |
| Right to object | Stopping certain processing | Separate right, absolute for direct marketing |
| AI system obligations | Risk management for AI providers and users | Complements, not replaces, data protection |
Outside the EU, similar ideas appear in other privacy laws. California regulators have adopted rules on automated decision-making technology that add notice, opt-out and access requirements for certain significant decisions, and several other jurisdictions have comparable provisions. The details and effective dates vary by jurisdiction.
Compliance in practice and common mistakes
Organizations that use automated decisions should first map every decision point where an algorithm affects individuals, then decide whether each one is solely automated and significant. A data protection impact assessment is generally expected for such processing because it is considered high risk.
| Mistake | Risk | Better practice |
|---|---|---|
| Token human review | Decision still counts as solely automated | Give reviewers authority and information |
| Vague explanations | Breach of transparency duties | Explain main factors and their effect |
| No route to contest | Missing mandatory safeguard | Offer a simple review request channel |
| Unchecked training data | Biased or discriminatory outcomes | Test outcomes across groups regularly |
Good practice also includes logging each automated decision with the input data, model version and main factors, so that a later review or complaint can reconstruct what happened. When the model changes, the organization should check that its explanations and impact assessment still match the system actually in use, rather than an earlier version.
In plain words
Automated decision-making means a computer decides something important about you on its own, such as whether you get a loan. European privacy law says this should not happen to you without protection.
If it does happen, you can ask a human to look at it again, explain your side and challenge the result. You can also ask what the main reasons for the decision were.
A real-world example
An applicant requests a small consumer loan through a bank’s mobile app. Within two minutes, the app rejects the application. The bank’s system had used a fully automated scoring model based on income, existing debts and payment history, relying on the contract exception of Article 22.
The applicant uses the in-app option to request human review and explains that a reported missed payment was a bank error that has since been corrected. A credit officer checks the records, confirms the error, corrects the data and approves the loan five days later. The bank also updates its source data. The case shows how the right to contest and rectification work together to fix a wrong automated outcome.