GDPR Q25
What is automated decision-making under GDPR?
Q25. What is automated decision-making under GDPR?
Category: Automation
Automated decision-making happens when important decisions are made without human involvement. GDPR gives people protection and a right to challenge these outcomes.
In simple terms
- Article 22 restricts decisions with legal or similarly significant effects.
- Individuals have the right to obtain human intervention and express their view.
- Use safeguards like transparency, accuracy checks, and meaningful explanations.
When Article 22 applies
Fully automated decisions that produce legal effects (e.g., credit approval, job screening) or similarly significant impacts require safeguards. Partial automation with human oversight may fall outside Article 22 but still needs fairness.
- You can only rely on automated decisions if necessary for a contract, authorised by law, or based on explicit consent.
- Special category data needs additional protection and usually explicit consent or legal authorisation.
- Keep documentation showing why automation is appropriate.
Safeguards for individuals
Inform people about automated decisions, provide an explanation of the logic involved, and offer a straightforward way to request human review.
- Regularly test algorithms for accuracy and bias.
- Allow individuals to challenge decisions and present additional information.
- Monitor outcomes and update models when they drift.
Practical steps to take
- Identify any processes that rely on automated decision-making or profiling.
- Confirm the lawful basis and check if Article 22 conditions are met.
- Implement human oversight procedures and escalation routes.
- Document explanations that you can share with affected individuals.
- Review systems regularly for fairness, accuracy, and security.
Real-life examples
Credit scoring
A lender uses an automated model to approve loans. Applicants receive a notice explaining the logic and how to request manual review.
Job screening
An employer uses automated CV screening but ensures recruiters review borderline cases and applicants can challenge outcomes.
Helpful reminders
- Children are protected from automated decisions producing significant effects.
- Document any explicit consent relied upon and make withdrawal simple.
- Combine DPIAs with model governance for high-risk automation.
Key takeaway
Automation must be fair, transparent, and challengeable—keep people in control of important decisions.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.