Our system produces a score and an employee clicks approve. Does that fall under Article 22?

Article 22(1) covers decisions based solely on automated processing. The article does not say how large the human role must be, but paragraph 3 lists the right to human intervention precisely as a safeguard against a fully automated decision. So assess honestly whether the employee actually evaluates the decision and can deviate from it, and record that.

Can we reject an online application fully automatically?

Only if an exception in paragraph 2 applies: the decision is necessary for entering into or performing a contract, it is authorised by a law that provides suitable safeguards, or it is based on explicit consent. Recital 71 names the automatic refusal of an online credit application as an example of a decision that significantly affects someone. For the exceptions under (a) and (c) you must provide the safeguards of paragraph 3.

What safeguards must we provide at a minimum for an automated decision?

Paragraph 3 lists at least three rights: human intervention on the part of the controller, the possibility for the data subject to express their point of view, and the possibility to contest the decision. Recital 71 adds specific information to the data subject and an explanation of the decision reached. In addition, the decision must not be based on special categories of personal data, unless point (a) or (g) of Article 9(2) applies (paragraph 4).

Article 22: Automated individual decision-making, including profilingAI-relevant

Praxikon tracks Article 22 (Automated individual decision-making, including profiling) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIIn force since 25-05-2018

Article 22 protects you against decisions that are taken entirely automatically, without a human looking at them, and that produce legal effects or otherwise significantly affect you (paragraph 1). Think of an automatic refusal of an online credit application or a job application rejected without any human intervention, for example by an AI system (recital 71). Such decisions are only allowed if they are necessary for a contract, authorised by law or based on your explicit consent (paragraph 2). Where the decision is based on a contract or on your consent, the controller must provide safeguards: at least the right to obtain human intervention, the right to express your point of view and the right to contest the decision (paragraph 3). The article exists because an automated evaluation of personal aspects, also called profiling, can cause errors and discrimination without anyone noticing (recital 71).

Key term: Solely automated decision: a decision taken entirely by a computer, without human intervention, that produces legal effects or similarly significantly affects a person

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

AI Act intersection

Automated decision-making is a core intersection with the AI Act: prohibited practices (Art. 5), human oversight (Art. 14), and deployer obligations (Art. 26).

AI Act Art. 5 →AI Act Art. 14 →AI Act Art. 26 →

Official text

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Paragraph 1 shall not apply if the decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. Section 5 Restrictions

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Decision tree

Is there a prohibited automated decision?

Article 22 in principle prohibits decisions taken solely by a system that significantly affect people. The Court of Justice reads the provision as a prohibition, not only as a right the data subject must invoke.

Question 1 · Art. 22(1)

What does the system do?

Full diagram

1
What does the system do?
Art. 22(1)
- It takes a decision about a person → Question 2
- It provides a score or prediction on which someone else decides → Question 3
- It only supports, without a decision about persons → Outcome A
2
Is the decision based solely on automated processing, without meaningful human involvement by someone with the authority and competence to change the decision?
Art. 22(1)
- Yes, solely automated → Question 4
- No, a human genuinely decides → Outcome B
3
Does your score or prediction play a determining role in the other party’s decision, because that party draws strongly on it, for example because a bank as a rule refuses credit at a low score?
Art. 22(1) · HvJ EU C-634/21
- Yes → Question 4
- No, it is one factor next to an own assessment → Outcome B
4
Does the decision produce legal effects for the person, or similarly significantly affect them?
Art. 22(1) · overweging 71
- Yes → Question 5
- No → Outcome C
5
Does one of the exceptions in paragraph 2 apply?
Art. 22(2) · art. 40 UAVG
- Necessary for a contract with the data subject → Question 6
- Authorised by Union or Member State law with suitable safeguards → Question 6
- Explicit consent of the data subject → Question 6
- None of these → Outcome E
6
Is the decision based on special category data, such as health, ethnic origin or biometrics?
Art. 22(4)
- Yes → Question 7
- No → Outcome D
7
Do you have explicit consent for those data, or is the processing necessary for reasons of substantial public interest on the basis of law, and have you put suitable measures in place?
Art. 22(4) · Art. 9(2)(a) en g
- Yes → Outcome D
- No → Outcome F

Outcome A · Does not apply

No decision within the meaning of Article 22

Without a decision about a person, Article 22 does not apply. The other GDPR rules do apply, such as the duty to inform, which also covers the existence of profiling and its consequences. Check whether the output later becomes decisive for decisions after all.

Art. 22(1) · art. 13 · art. 14 · overweging 60

Outcome B · Does not apply

Not a solely automated decision

With meaningful human assessment the decision falls outside Article 22. Record who assesses, which information that person has and how often the system outcome is overridden.

Art. 22(1)

Outcome C · Does not apply

No significant effect: Article 22 does not apply

Without legal effect or a similarly significant effect the decision falls outside the prohibition. The right to information about profiling and the right to object may still apply.

Art. 22(1) · art. 21

Outcome D · Partly applies

Allowed with safeguards

With a contract or explicit consent you must at least offer the right to obtain human intervention, to express a point of view and to contest the decision. With a statutory exception the safeguards in that law apply. Inform data subjects of the existence of the decision and give meaningful information about the logic involved and the consequences.

Art. 22(2) · Art. 22(3) · Art. 13(2)(f) · Art. 15(1)(h)

Outcome E · Prohibited

Prohibited automated decision

Without an exception under paragraph 2 you may not take this decision solely by automated means. Add meaningful human assessment, or stop this form of decision making.

Art. 22(1) · Art. 22(2)

Outcome F · Prohibited

Prohibited: decision based on special category data

An automated decision may only be based on special category data with explicit consent or substantial public interest on the basis of law, with suitable measures. Remove these data from the decision or add meaningful human assessment.

Art. 22(4) · Art. 9(2)(a) en g

What does this mean for you?

Controller

Map which decisions in your organisation are taken entirely automatically and whether they produce legal effects or significantly affect someone (paragraph 1). If so, check whether an exception in paragraph 2 applies and, for the exceptions under (a) and (c), arrange at least human intervention, the possibility to express a point of view and the possibility to contest the decision (paragraph 3). Do not base such decisions on special categories of personal data, unless point (a) or (g) of Article 9(2) allows it and you have suitable measures in place (paragraph 4).

Data Subject

You do not have to accept that a computer alone takes a decision about you that produces legal effects or significantly affects you (paragraph 1). If such a decision is allowed because it is necessary for a contract or because you gave explicit consent, you can ask a human to look at it, give your side of the story and contest the decision (paragraph 3).

Compliance checklist

There is an overview of all decisions taken solely by automated means, including profiling, and for each decision it has been assessed whether it produces legal effects or significantly affects the data subject (paragraph 1).For each decision covered by paragraph 1 it is recorded which exception it relies on: necessary for a contract, authorised by law, or explicit consent (paragraph 2).For a decision based on a contract or consent, the data subject can obtain human intervention on the part of the controller (paragraph 3).The data subject can express their point of view and contest the decision, and there is a procedure that handles this (paragraph 3).Automated decisions are not based on special categories of personal data, unless point (a) or (g) of Article 9(2) applies and suitable measures are in place (paragraph 4).A legal basis under Article 6 is recorded for the profiling itself, because profiling is subject to all the ordinary rules of the GDPR (recital 72).For profiling, appropriate mathematical or statistical procedures are used and inaccuracies in personal data are corrected to prevent wrong or discriminatory outcomes (recital 71).Solely automated decisions with legal effects are not taken about children (recital 71).

Related recitals

(71)

The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing an...

(72)

Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for processing or data protection principles. The European Data Protection Boa...

Cross-references

Art. 9: Processing of special categories of personal data

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Guidelines and decisions (2)

17 September 2026 · v2.0 · EDPB
Guidelines 3/2025 on the interplay between the DSA and the GDPR
Describes how obligations under the Digital Services Act and the GDPR apply together, including for content moderation, recommender systems and advertising.
19 November 2025 · COM(2025) 837 · European Commission
Digital Omnibus: proposal amending the GDPR
Legislative proposal that would introduce, among other things, a relative definition of personal data, breach notification only for high risk and cookie rules within the GDPR itself. It is a proposal, not law in force.

Line of case lawAutomated decision-making

When is a score a decision, and what explanation do you get?

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (2018)The guidelines read Article 22 as a prohibition with exceptions.
SCHUFA (scoring) (2023)A credit score a bank relies on heavily is itself a decision.
Dun & Bradstreet Austria (2025)Right to an intelligible explanation of procedure and principles.
Digital Omnibus: proposal amending the GDPR (2025)Proposal to rewrite Article 22.

Checked on 1 October 2026

Frequently asked questions

← Art. 21: Right to object Art. 23: Restrictions →

Connections

Themes where this returns

Where this meets the other law

Human oversight under the AI Act and Article 22 GDPR: only meaningful involvement counts
does not replace
Profiling in the GDPR sense always makes an Annex III system high-risk
uses the definition in
The right to explanation in Article 86 only supplements the GDPR
applies only in addition to

The counterpart in the other law

Case law

Dun & Bradstreet: right to an intelligible explanation of an automated decision, trade secrets are no absolute ground for refusal
2025-02-27 · final, Hof van Justitie van de EU (Eerste kamer), CK tegen Magistrat der Stadt Wien, met Dun & Bradstreet Austria GmbH als andere partij
SCHUFA: a credit score on which third parties draw strongly is automated decision-making
2023-12-07 · final, Hof van Justitie van de EU (Eerste kamer), OQ tegen Land Hessen, met SCHUFA Holding AG als interveniënt

Guidelines

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679
2018-05-25 · final, Article 29 Working Party, bekrachtigd door de European Data Protection Board (EDPB)
EDPB and EDPS adopt Joint Opinion 2/2026 on the Digital Omnibus
2026-02-10 · final, European Data Protection Board en European Data Protection Supervisor