European UnionGDPR Article 22, Automated Individual Decision-Making
Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Do not subject a natural person to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless it is necessary to enter into or perform a contract with them, is authorised by a law that itself safeguards their rights, or rests on their explicit consent.NIST Privacy FrameworkCT.DM-P10
- Where relying on the contract-necessity or explicit-consent exception, implement suitable safeguards, at minimum the right to obtain human intervention, to express a point of view, and to contest the decision.NIST Privacy FrameworkCT.PO-P3
- Do not base such a decision on special category data under Article 9(1) unless the data subject gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.NIST Privacy FrameworkCT.PO-P1
- Tell the data subject, when collecting their data (or, where the data came from another source, within the Article 14(3) period) and on any access request, that this kind of automated decision-making occurs, and give meaningful information about the logic involved, the significance, and the envisaged consequences.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: European Data Protection Board (guidance, recorded ); Case C-634/21 SCHUFA Holding (Scoring), judgment of (First Chamber) (recorded ).
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 83(5)(b) subjects an infringement of the data subjects' rights in Articles 12 to 22, Article 22 included, to the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
The data protection supervisory authority designated by each EU Member State under Article 51, coordinated on cross-border cases through the one stop shop mechanism, which does not apply to processing by public authorities or by private bodies acting under Article 6(1)(c) or (e) (Article 55(2)), and through the European Data Protection Board (Articles 68-76).
Enforcement record
Counts the fines that national data protection authorities imposed in calendar year 2025 (2,161): the sum of the number-of-fines column in the European Data Protection Board's Annual Report 2025, which gives for each of 30 authorities (the 27 Member States, Iceland, Liechtenstein and Norway) the number and the total amount of the fines it issued that year. The report's own total of those amounts is EUR 1,145,760,374. Fines only: the table does not count the reprimands, warnings, compliance orders or processing bans the authorities may also impose. Enforcement of the GDPR is national, and this table is the Board's Union-level count of it. The figures describe enforcement of the GDPR as a whole, not enforcement of Article 22 alone.
- As of
- Currency
- EUR
- Source link
- https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf
- Fines per year
- 1,145,760,374
- Actions per year
- 2,161
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634
- Guidance link
- https://www.edpb.europa.eu/documents/guideline/automated-decision-making-and-profiling_en
- Case citation
- Case C-634/21 SCHUFA Holding (Scoring), judgment of (First Chamber)
- Guidance body
- European Data Protection Board
- Open questions
- When does a recipient 'draw strongly' on a probability value, so that the supplier's automated score is itself a decision under Article 22(1), where a person at the recipient formally takes the final decision?
- How much of the 'procedure and principles actually applied' must a controller explain under Article 15(1)(h) as 'meaningful information about the logic involved', as Case C-203/22 requires, where it holds that the explanation contains a trade secret or data of third parties that it must give only to the supervisory authority or court?
What it makes you log
Logging duty
Article 22(3) requires suitable safeguards for a solely automated decision, at least the right to obtain human intervention, to express a point of view and to contest the decision, and Articles 13(2)(f), 14(2)(g) and 15(1)(h) require information about the logic involved. None of the articles this row cites names a log, record or document.
- Kind
- None
- As of
Also on the record
EEA status
- Annex
- XI
- Status
- Incorporated
- Force date
- Joint committee decision number
- 154/2018
- Source link
- https://www.efta.int/eea-lex/32016r0679
- Decision date
What this law does
Article 22(1) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.
Article 22(2) narrows that right where the decision is necessary to enter into or perform a contract with the data subject, is authorised by Union or Member State law that itself safeguards the data subject's rights, or rests on the data subject's explicit consent, and Article 22(3) conditions the contract and consent exceptions on suitable safeguards, at minimum the right to obtain human intervention, to express a point of view, and to contest the decision.
Article 22(4) forbids basing such a decision on special category data under Article 9(1) unless the data subject gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, again with suitable safeguards.
Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the data subject, at collection (Article 13), within the Article 14(3) period where the data came from another source, and on an access request (Article 15), that automated decision-making of the kind Article 22(1) and (4) describes occurs and to give, at least in those cases, meaningful information about the logic involved, the significance, and the envisaged consequences.
The Court of Justice held in SCHUFA (Case C-634/21, ) that a credit information agency's automated credit score falls within Article 22 where a third party to which it is transmitted draws strongly on it to establish, implement or terminate a contractual relationship, even though the scoring entity is not the final decision maker.
How courts have read itPremium data
Our analysis of this law draws on 5 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .