Automated Decision-Making and Profiling Under the GDPR

Under the General Data Protection Regulation, you can refuse to be subject to a decision made solely by an algorithm when that decision carries legal consequences or similarly significant effects on your life. That is the core of automated decision-making and profiling under the GDPR: Article 22 gives you the right to push back, Articles 13 through 15 force organizations to explain what their systems are doing, and Article 35 requires them to assess the risks before they ever switch the system on.¹ The protection covers credit scoring, hiring filters, insurance pricing, fraud screening, and any similar process where software alone determines the outcome.

Profiling itself is defined broadly in Article 4(4): using personal data to evaluate someone’s work performance, financial situation, health, preferences, reliability, behavior, or movements.² A retailer suggesting products from your browsing history is profiling. So is a bank scoring your creditworthiness. The GDPR treats them differently because the consequences differ.

When Article 22 Actually Applies

Two conditions must both be met before Article 22’s strongest protections apply. The decision has to be based solely on automated processing, with no meaningful human involvement. And it has to produce legal effects or similarly significantly affect you.¹

A legal effect changes your legal status or rights. Being denied a loan, losing a benefit, or having a contract terminated all qualify. A “similarly significant” effect is broader: it reaches your financial position, health, reputation, or access to services. Automated rejection from a rental application or a job screening funnel falls inside that category.

The word “solely” carries a lot of weight. If a human genuinely reviews the case and can override the software, Article 22 does not apply. But rubber-stamping does not count. Regulators have said the human reviewer must have the authority, competence, and willingness to change the outcome. Organizations that insert a nominal checkpoint where nobody ever overrides anything have not escaped Article 22; they have just tried to.

The Three Exceptions

Article 22(2) allows solely automated decisions with significant effects in three situations, even over your objection.¹

Contractual necessity, where the automated decision is needed to enter into or perform a contract with you. Automated credit card eligibility checks during an application are the standard example.
Legal authorization, where EU or member state law specifically permits the processing and builds in safeguards. Fraud detection, anti-money laundering screening, and tax compliance systems typically sit here.
Explicit consent, which is a higher bar than ordinary consent. You must know you are agreeing to automated decision-making, understand what kinds of decisions will follow, and appreciate the consequences.

Even when an exception applies, the organization does not get a clean pass. For contract-based and consent-based decisions, you keep procedural rights, including human review.

Sensitive Data Gets Stricter Treatment

Automated decisions built on special categories of personal data face an additional restriction under Article 22(4). Special categories include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, and information about sex life or sexual orientation.¹

Automated decisions cannot generally rely on these data types. Recital 71 explains the reasoning: preventing discriminatory effects based on race, political opinion, religion, union membership, genetic or health status, and sexual orientation.³ Only two narrow exceptions apply: explicit consent, or processing necessary for a substantial public interest under EU or member state law. Safeguards are required in either case.

What Organizations Must Tell You

Organizations using automated decision-making have to disclose it. Articles 13 and 14 require them to tell you that automated processing is happening, provide meaningful information about the logic involved, and explain the significance and expected consequences.⁴ When your data is collected directly from you, that notice must arrive at the point of collection. When it comes from other sources, the organization has up to one month.⁵

Article 15 gives you the parallel right to ask at any time. Submit an access request, and the organization must confirm whether automated decision-making is in play, explain the logic, and describe the likely consequences.⁶

This does not force disclosure of source code or proprietary algorithms. The explanation has to be intelligible to a non-technical person. A credit scoring system should say which financial behaviors it looks at and roughly how they affect the outcome. A hiring filter should disclose the qualifications or keywords it prioritizes. Specific enough that you can spot whether the system worked from inaccurate or outdated information.

Your Rights to Review, Voice, and Challenge

When an automated decision is made under the contract or consent exception, Article 22(3) preserves three procedural rights.¹

Human intervention. You can demand that a real person review the decision, and that person must have the authority and competence to override the algorithm. Re-running the same automated process does not qualify.
Expressing your point of view. You can add context the system missed, such as a temporary medical emergency behind a sudden credit score drop, and the organization must actually consider it in the review.
Contesting the decision. You can formally challenge the outcome, which triggers an internal review for data protection compliance.

Recital 71 adds a right to obtain an explanation of the decision reached after the review.³ Responses must come without undue delay and within one month, though complex cases can be extended by two more months if the organization notifies you within that first month.⁷

Objecting to Profiling Under Article 21

Article 21 sits alongside Article 22 and is sometimes the stronger tool. When profiling is based on legitimate interests or a public task, you can object at any time on grounds relating to your particular situation. The organization must then stop unless it can demonstrate compelling legitimate grounds that override your interests.⁸

For direct marketing, the right is absolute. Profiling used for marketing purposes stops on your objection, with no balancing test.⁸ Behavioral advertising, personalized email campaigns, and any profiling that feeds targeted marketing all fall within that absolute right.

What Organizations Must Do Before Switching the System On

Before deploying an automated decision-making system with significant effects, an organization must run a Data Protection Impact Assessment. Article 35(3)(a) makes a DPIA mandatory for any systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where the resulting decisions produce legal effects or similarly significantly affect people.⁹

The assessment must describe the planned processing and its purposes, evaluate whether it is necessary and proportionate, assess the risks to individuals’ rights and freedoms, and document the mitigation measures the organization will put in place.⁹ Any significant change to the system or its scope means running the assessment again. Credit scoring, automated hiring tools, insurance risk calculators, and fraud detection systems all typically require one.

The AI Act Adds a Second Layer From August 2026

Starting August 2, 2026, the EU AI Act’s rules for high-risk AI systems listed in Annex III enter into force, sitting on top of the GDPR for many of the same tools.¹⁰ Annex III classifies as high-risk many systems the GDPR already governs, including AI used for recruitment and worker evaluation, credit scoring, and law enforcement profiling.¹¹

One rule is worth flagging directly. Any Annex III system that performs profiling of natural persons is always classified as high-risk, with no possibility of using the derogation that lets other Annex III systems escape that classification for narrow procedural tasks.¹²

The AI Act also creates its own right to explanation in Article 86. When a deployer uses a high-risk Annex III system to make a decision that produces legal effects or similarly significantly affects you, and you consider the decision to adversely affect your health, safety, or fundamental rights, you can demand clear and meaningful explanations of the AI’s role and the main elements of the outcome.¹³ This right applies only where existing EU law does not already cover it, so for decisions already governed by GDPR Article 22, the AI Act fills gaps rather than duplicating what is there.

Reach Beyond the EU

These rules are not confined to EU-based organizations. Article 3(2) extends the GDPR to organizations outside the EU when they offer goods or services to people in the EU or monitor the behavior of people within the EU.¹⁴ Behavioral monitoring is directly relevant to profiling: a platform that tracks browsing or purchasing behavior of EU users to build profiles is almost certainly caught, wherever its servers live. Organizations covered by the extraterritorial provisions must appoint a written representative in an EU member state where affected individuals are located.¹⁵

Fines

Violations of Article 22 and the related rights sit in the GDPR’s top fine tier. Article 83(5) sets the ceiling at €20 million or 4 percent of the organization’s total worldwide annual turnover for the preceding financial year, whichever is higher, for infringements of data subject rights under Articles 12 through 22.¹⁶ EU data protection authorities have imposed nine-figure fines in cases involving profiling and automated processing, particularly in behavioral advertising and social media.

1
General Data Protection Regulation (GDPR). GDPR Article 22 – Automated Individual Decision-Making, Including Profiling
2
General Data Protection Regulation (GDPR). GDPR Article 4 – Definitions
3
Privacy Regulation. Recital 71 EU General Data Protection Regulation
4
General Data Protection Regulation (GDPR). GDPR Article 13 – Information To Be Provided Where Personal Data Are Collected From the Data Subject
5
GDPR-Info.eu. GDPR Article 14 – Information To Be Provided Where Personal Data Have Not Been Obtained From the Data Subject
6
General Data Protection Regulation (GDPR). GDPR Article 15 – Right of Access by the Data Subject
7
GDPR-Info.eu. GDPR Article 12 – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
8
General Data Protection Regulation (GDPR). GDPR Article 21 – Right To Object
9
GDPR-Info.eu. GDPR Article 35 – Data Protection Impact Assessment
10
AI Act Service Desk. Timeline for the Implementation of the EU AI Act
11
Artificial Intelligence Act. Annex III – High-Risk AI Systems Referred to in Article 6(2)
12
Artificial Intelligence Act. Article 6 – Classification Rules for High-Risk AI Systems
13
Artificial Intelligence Act. Article 86 – Right to Explanation of Individual Decision-Making
14
European Data Protection Board. Guidelines 3/2018 on the Territorial Scope of the GDPR (Article 3)
15
General Data Protection Regulation (GDPR). GDPR Article 27 – Representatives of Controllers or Processors Not Established in the Union
16
GDPR-Info. GDPR Article 83 – General Conditions for Imposing Administrative Fines