In short. GDPR Article 22 prohibits in principle solely automated decisions with legal or similarly significant effects unless an exception applies and required safeguards are provided.
Definition: Article 22 of the General Data Protection Regulation (GDPR) applies to decisions about individuals based solely on automated processing that produce legal effects or similarly significantly affect them. These decisions are prohibited in principle unless an exception applies and the required safeguards are provided.
Key facts
- As of 17 October 2026, GDPR Article 22(2) permits exceptions for contractual necessity, authorisation by EU or Member State law, or explicit consent.
- The Article 29 Working Party's automated decision-making guidelines identify personalised pricing that effectively excludes someone from goods or services as a possible significant effect.
- The Court of Justice's SCHUFA judgment, paragraph 52, treats Article 22(1) as a prohibition that applies without an individual first invoking it.
Which customer decisions have sufficiently serious effects?
The Working Party guidelines explain that a legal effect changes a person's legal rights, legal status or contractual rights. Cancelling a contract is an example. A similarly significant effect must reach a comparable level of seriousness, such as affecting eligibility for credit.
For website advertising, the same guidelines say that many typical targeting decisions fall below this threshold. The assessment can change with intrusive tracking, how an advertisement is delivered or the use of knowledge about a person's vulnerabilities. Their example concerns someone in financial difficulty repeatedly receiving advertisements for high-interest loans and potentially incurring further debt.
What counts as meaningful human involvement?
The Working Party guidelines require a reviewer with the authority and competence to change the decision and consideration of all relevant data. Routinely applying an automatically generated assessment without influencing the result remains solely automated decision-making.
External scoring also matters. In its SCHUFA judgment of 7 December 2023, paragraph 73, the Court holds that a credit agency's automated probability score constitutes automated individual decision-making when a third party draws strongly on it to establish, implement or terminate a contractual relationship.
Which exceptions and safeguards apply?
Under GDPR Article 22(2), contractual necessity concerns entering into or performing a contract with the individual. The law-based exception requires the authorising law itself to provide suitable safeguards. Explicit consent is the remaining exception.
For contractual necessity, the Working Party guidelines require consideration of effective, less intrusive alternatives. An available alternative can defeat a claim that solely automated processing is necessary.
The controller is the person or organisation determining the purposes and means of personal-data processing, as defined in GDPR Article 4(7). For the contract and explicit-consent exceptions, Article 22(3) requires the controller to provide at least human intervention, an opportunity to express a viewpoint and a way to contest the decision. The guidelines require the reviewer to consider additional information supplied by the individual.
Article 22(4) further restricts decisions based on special categories of personal data, including health data under Article 9(1). Such decisions require Article 9(2)(a), concerning explicit consent, or Article 9(2)(g), concerning substantial public interest under law, plus suitable safeguards.
What information and assessment does a website need?
GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h) cover information about the existence of relevant automated decision-making, meaningful information about its logic, and its significance and envisaged consequences. They provide information duties and a corresponding right of access.
A data protection impact assessment examines the envisaged processing's effects on personal-data protection. Article 35 requires it before processing likely to create high risks. Article 35(3)(a) specifically covers systematic and extensive evaluation of personal aspects based on automated processing where resulting decisions have legal or similarly significant effects.
Related terms
- GDPR lawful basis for web data
- Data protection impact assessment
- GDPR transparency for web collection
FAQ
Can I rely only on legitimate interests?
Article 22(2)'s exceptions in the GDPR are contractual necessity, authorisation by law and explicit consent. Legitimate interests alone supplies no exception to this prohibition.
Can a staff member simply approve the system's result?
The Working Party guidelines require meaningful review by someone able to change the decision. A routine approval without actual influence on the result leaves the decision solely automated.
Sources
- European Parliament and Council, "Regulation (EU) 2016/679", 27 April 2016
- Article 29 Data Protection Working Party, "Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679", revised 6 February 2018
- Court of Justice of the European Union, "SCHUFA Holding (Scoring), C-634/21", 7 December 2023
Check how a page reads to answer engines. Open the GEO score analyzer