What is GDPR Article 22?
- Article 22(1) is read as a prohibition in principle, not a right the individual must invoke.
- Two thresholds must both be met: the decision is solely automated, and the effect is legal or similarly significant.
- Permitted only where necessary for a contract, authorised by law, or based on explicit consent — with safeguards.
- Modern scoring, ranking, eligibility and risk systems routinely fall inside its scope.
- General information, not legal advice. Current as of July 2026.
The rule
Article 22(1) of the GDPR states that a person has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. The European Data Protection Board and, before it, the Article 29 Working Party read this not as a right the individual must actively invoke, but as a prohibition in principle: solely automated decisions of this kind are forbidden unless they fall within one of three exceptions.
Solely automated, and significant
Two thresholds must both be met. The decision must be solely automated, meaning no meaningful human involvement; a person who merely rubber-stamps an algorithm's output, without genuine authority or capacity to decide differently, does not make the process non-automated. And the effect must be legal or similarly significant: the loss of a loan, a job, an insurance policy, or a place on a course qualifies; a trivial personalisation usually does not.
The three exceptions and their safeguards
A solely automated significant decision is permitted only if it is necessary for entering into or performing a contract, or authorised by EU or member-state law, or based on the individual's explicit consent. In the contract and consent cases, the controller must give the individual the right to obtain human intervention, to express their point of view, and to contest the decision. Where special-category data (such as health or ethnicity) is involved, the bar is higher still.
Why it reaches modern AI
Article 22 predates the current wave of AI but lands squarely on it, because so many AI systems produce exactly the kind of scores and classifications that drive significant decisions. Any organisation running automated scoring, ranking, eligibility, or risk systems that materially shape outcomes for people should assume Article 22 is in play and design for its safeguards from the start.
Key terms
- Solely automated
- A decision made without meaningful human involvement in the outcome.
- Profiling
- Automated processing of personal data to evaluate personal aspects of an individual.
- Legal or significant effect
- An outcome that materially affects a person's rights, opportunities, or access.
- Human intervention
- Review by a person with genuine authority to reach a different outcome.
- Prohibition in principle
- The regulator reading that Article 22 forbids covered decisions unless an exception applies.