What is GDPR Article 22 (automated decision-making)?

Automated decision-making is where profiling stops being analysis and starts changing outcomes for a person. Article 22 of the EU GDPR is the rule that governs it. It gives people a default protection against being judged by an algorithm alone when the stakes are high, then sets out the narrow cases where you may do it and what you must build around it. If you run credit scoring, automated hiring filters, or fraud models that act without a human, this is your article.

What does Article 22 actually say?

Under Article 22(1), the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Two conditions have to be true for the core rule to apply. The decision must be solely automated, meaning there is no meaningful human involvement, and it must have a legal or similarly significant effect, such as refusing a loan, ending a service, or rejecting a job application. If a person genuinely reviews the outcome and can change it, or the effect is trivial, you are outside Article 22's specific regime, though every other GDPR duty still applies.

When are automated decisions allowed?

Article 22(2) sets three grounds, and you need one of them to make a qualifying automated decision. The decision can be necessary for entering into or performing a contract between the person and the controller. It can be authorised by Union or Member State law that also lays down suitable safeguards. Or it can be based on the person's explicit consent. These are narrow. Explicit consent is a higher bar than ordinary consent, and contract necessity means the automated decision is genuinely required, not merely convenient. Choosing a ground is the first thing a regulator will ask you to show.

What safeguards must you put in place?

Where you rely on contract necessity or explicit consent, Article 22(3) requires suitable measures to safeguard the person's rights and freedoms, and it names a floor: at least the right to obtain human intervention on the part of the controller, to express their point of view, and to contest the decision. Build those as real routes, not a form nobody answers. Article 22(4) adds a hard limit: a solely automated decision cannot be based on special category data under Article 9(1) unless Article 9(2)(a) or (g) applies and suitable safeguards are in place. Profiling that leans on health, biometrics, or similar data faces this extra gate.

How it fits your other GDPR duties

Article 22 sits next to the other individual rights. A person can object to processing under Article 21, including profiling, and where you profile on the basis of legitimate interests the two rights interact. You also owe transparency about the logic involved when you carry out this kind of processing, which links back to your privacy information duties. Treat automated decisions as a mapped, documented category rather than something buried inside a model.

Next step

If you use profiling or automated scoring and are not sure whether Article 22 applies or which safeguards you owe, the free 2-minute Obligation Scan flags where the GDPR reaches you and which data-subject rights you need a process for. The GDPR compliance hub sets the duties in order.