Our system produces a score and an employee clicks approve. Does that fall under Article 22?

Article 22(1) covers decisions based solely on automated processing. The article does not say how large the human role must be, but paragraph 3 lists the right to human intervention precisely as a safeguard against a fully automated decision. So assess honestly whether the employee actually evaluates the decision and can deviate from it, and record that.

Can we reject an online application fully automatically?

Only if an exception in paragraph 2 applies: the decision is necessary for entering into or performing a contract, it is authorised by a law that provides suitable safeguards, or it is based on explicit consent. Recital 71 names the automatic refusal of an online credit application as an example of a decision that significantly affects someone. For the exceptions under (a) and (c) you must provide the safeguards of paragraph 3.

What safeguards must we provide at a minimum for an automated decision?

Paragraph 3 lists at least three rights: human intervention on the part of the controller, the possibility for the data subject to express their point of view, and the possibility to contest the decision. Recital 71 adds specific information to the data subject and an explanation of the decision reached. In addition, the decision must not be based on special categories of personal data, unless point (a) or (g) of Article 9(2) applies (paragraph 4).

Article 22: Automated individual decision-making, including profilingAI-relevant

Praxikon tracks Article 22 (Automated individual decision-making, including profiling) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 22 protects you against decisions that are taken entirely automatically, without a human looking at them, and that produce legal effects or otherwise significantly affect you (paragraph 1). Think of an automatic refusal of an online credit application or a job application rejected without any human intervention, for example by an AI system (recital 71). Such decisions are only allowed if they are necessary for a contract, authorised by law or based on your explicit consent (paragraph 2). Where the decision is based on a contract or on your consent, the controller must provide safeguards: at least the right to obtain human intervention, the right to express your point of view and the right to contest the decision (paragraph 3). The article exists because an automated evaluation of personal aspects, also called profiling, can cause errors and discrimination without anyone noticing (recital 71).

Key term: Solely automated decision: a decision taken entirely by a computer, without human intervention, that produces legal effects or similarly significantly affects a person

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Automated decision-making is a core intersection with the AI Act: prohibited practices (Art. 5), human oversight (Art. 14), and deployer obligations (Art. 26).

AI Act Art. 5 →AI Act Art. 14 →AI Act Art. 26 →

Official text

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Paragraph 1 shall not apply if the decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. Section 5 Restrictions

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Map which decisions in your organisation are taken entirely automatically and whether they produce legal effects or significantly affect someone (paragraph 1). If so, check whether an exception in paragraph 2 applies and, for the exceptions under (a) and (c), arrange at least human intervention, the possibility to express a point of view and the possibility to contest the decision (paragraph 3). Do not base such decisions on special categories of personal data, unless point (a) or (g) of Article 9(2) allows it and you have suitable measures in place (paragraph 4).

Data Subject

You do not have to accept that a computer alone takes a decision about you that produces legal effects or significantly affects you (paragraph 1). If such a decision is allowed because it is necessary for a contract or because you gave explicit consent, you can ask a human to look at it, give your side of the story and contest the decision (paragraph 3).

Compliance checklist

There is an overview of all decisions taken solely by automated means, including profiling, and for each decision it has been assessed whether it produces legal effects or significantly affects the data subject (paragraph 1).For each decision covered by paragraph 1 it is recorded which exception it relies on: necessary for a contract, authorised by law, or explicit consent (paragraph 2).For a decision based on a contract or consent, the data subject can obtain human intervention on the part of the controller (paragraph 3).The data subject can express their point of view and contest the decision, and there is a procedure that handles this (paragraph 3).Automated decisions are not based on special categories of personal data, unless point (a) or (g) of Article 9(2) applies and suitable measures are in place (paragraph 4).A legal basis under Article 6 is recorded for the profiling itself, because profiling is subject to all the ordinary rules of the GDPR (recital 72).For profiling, appropriate mathematical or statistical procedures are used and inaccuracies in personal data are corrected to prevent wrong or discriminatory outcomes (recital 71).Solely automated decisions with legal effects are not taken about children (recital 71).

Related recitals

(71)

The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing an...

(72)

Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for processing or data protection principles. The European Data Protection Boa...

Cross-references

Art. 9: Processing of special categories of personal data

Frequently asked questions

← Art. 21: Right to object Art. 23: Restrictions →

Connections

Themes where this returns

The counterpart in the other law

Case law

Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal
2025-02-27 · final, Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt

Guidelines

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor