GDPR Article 22 and automated decision-making

What it is

The General Data Protection Regulation, Regulation (EU) 2016/679, is the EU’s data protection law, applying since 25 May 2018. Article 22 is its specific rule on automated individual decision-making, including profiling. It is the oldest binding rule in Europe aimed squarely at algorithmic decisions about people, and it applies to AI systems as much as to rule-based scoring.

Article 22(1) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The Article 29 Working Party’s guidelines on automated decision-making and profiling (WP251rev.01), endorsed by the European Data Protection Board, read this as a general prohibition with exceptions, rather than a right someone has to invoke.

Article 22 does not stand alone. Articles 13, 14 and 15 add transparency duties, and Article 35 requires a data protection impact assessment for this kind of processing. Together they set the baseline for any AI that decides things about people in the EU.

Who it applies to

The GDPR applies to controllers and processors established in the EU, and to those outside the EU that offer goods or services to people in the EU or monitor their behaviour. Article 22 duties fall on the controller, the organisation that decides why and how the personal data is processed. Buying an AI system from a vendor does not move that responsibility to the vendor.

The rule is engaged when three conditions meet. There is a decision about an individual. It is based solely on automated processing, with no meaningful human involvement. And it produces legal effects, such as refusing a benefit or cancelling a contract, or similarly significant effects, such as automatic refusal of credit, e-recruiting without human review, or decisions that affect access to health services or education.

What it requires

A lawful exception. A solely automated decision with significant effects is allowed only where it is necessary for entering into or performing a contract with the person, authorised by EU or member state law with suitable safeguards, or based on the person’s explicit consent (Article 22(2)).

Safeguards. Where the contract or consent exception is used, the controller must at least give the person the right to obtain human intervention, to express their point of view and to contest the decision (Article 22(3)). The human who reviews must have the authority and competence to change the outcome.

Special category data. Decisions based on health, ethnicity, religion, biometric or other special category data are allowed only with explicit consent or for reasons of substantial public interest under law, and with suitable measures to protect the person (Article 22(4)).

Transparency. When personal data is collected or obtained, and on request, the controller must disclose the existence of automated decision-making, meaningful information about the logic involved, and the significance and envisaged consequences for the person (Articles 13(2)(f), 14(2)(g) and 15(1)(h)). In Dun & Bradstreet Austria (C-203/22, February 2025) the Court of Justice held that this requires an explanation of the procedure and principles actually applied, in a concise and intelligible form. Trade secrets do not remove the duty, though a court or supervisory authority can balance them.

Impact assessment. Article 35(3)(a) requires a DPIA before systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based. The DPIA describes the processing, assesses necessity and proportionality, assesses risks to people’s rights, and sets out the measures to address them.

What counts as a decision. In SCHUFA (C-634/21, December 2023) the Court held that a credit agency’s automated generation of a probability score is itself a decision under Article 22 where a lender draws strongly on that score to decide. A score, ranking or recommendation can therefore engage Article 22 even where another organisation signs off the final step.

Breaches of data subject rights, including Article 22, can attract fines up to 20 million euros or 4 percent of worldwide annual turnover under Article 83(5).

Key dates

The GDPR has applied since 25 May 2018, and Article 22 has not been amended. The EDPB guidelines on automated decision-making and profiling were endorsed when the Board was established in May 2018. The CJEU’s SCHUFA judgment (7 December 2023) and Dun & Bradstreet Austria judgment (27 February 2025) are the leading interpretations.

On 19 November 2025 the European Commission proposed a Digital Omnibus covering data protection and other digital rules. It would rework Article 22, including clarifying when an automated decision is necessary for a contract. As of October 2026 the proposal is still with the European Parliament and Council and has not been adopted. The current Article 22 applies in full until any amendment is adopted and in force. The AI half of the Omnibus, Regulation (EU) 2026/1744, is a separate instrument that amends only the AI Act.

How it relates to other frameworks

The EU AI Act applies on top of the GDPR, not instead of it. A high-risk AI system that makes decisions about people needs to meet both, and the Act’s fundamental rights impact assessment for deployers can build on an existing DPIA. The Act’s Article 86 right to an explanation for high-risk decisions sits alongside the GDPR transparency duties rather than replacing them.

The UK started from the same text but has since diverged. The UK GDPR’s Articles 22A to 22D, in force since 5 February 2026, move most automated decisions from a prohibition to a permission with safeguards. An organisation operating in both places needs to handle the two separately.

For the impact assessment itself, ISO/IEC 42005 and the HUDERIA methodology offer structured ways to assess effects on people that go beyond data protection risk. A register of AI systems that records which ones make or inform decisions about people is the practical starting point for finding where Article 22 is engaged.