Primary source. Reproduces the operative text of Article 22 of the General Data Protection Regulation as published by gdpr-info.eu. The textual anchor for the entire legal-risk cluster on AI-driven process automation.

⚠️ Citation note. gdpr-info.eu is a private publication. For formal citation use the authoritative version on EUR-Lex — Regulation (EU) 2016/679 of 27 April 2016, OJ L 119, 4.5.2016, p. 1, Article 22. This source page is for working reference, not authority.

Article 22 — full text

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

2. Paragraph 1 shall not apply if the decision:

(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;
(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
(c) is based on the data subject's explicit consent.

3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

Operative concepts

"Solely automated" — interpreted by WP29 / EDPB and Amsterdam case-law as requiring meaningful prior human intervention to lift the prohibition. Nominal rubber-stamping does not satisfy. See Lazcoz & de Hert 2023 for the doctrinal analysis.
"Legal effects or similarly significantly affects" — covers e.g. credit scoring (CJEU SCHUFA C-634/21, Dec 2023), employment decisions, insurance underwriting, online platform deactivation (Amsterdam Uber/Ola cases 2021–2023).
"Profiling" — defined in Art. 4(4) GDPR: any form of automated processing of personal data evaluating personal aspects, in particular to analyse or predict aspects concerning performance, economic situation, health, preferences, behaviour, location, movements.
The three exceptions are exhaustive. (b) is vaguely drafted — silent on what "suitable measures" satisfy.
Three types of decisions (per Lazcoz & de Hert 2023 Fig. 1):
1. No-Art. 22 decisions — no legal/significant effect → out of scope.
2. Art. 22(1) decisions — solely automated + legal/significant effect → prohibited unless human-in-the-loop.
3. Art. 22(2) decisions — meet one of three exceptions → allowed, but require Art. 22(3) safeguards (right to obtain intervention, express POV, contest).

Linked recitals

Recital 71 — Profiling. The data subject should have the right not to be subject to a decision based solely on automated processing. Such processing should be subject to suitable safeguards including specific information, the right to obtain human intervention, the right to express POV, the right to obtain an explanation of the decision reached, the right to challenge.
Recital 72 — Profiling subject to GDPR rules; EDPB shall issue guidance.
Recital 91 — DPIA (Art. 35) necessity, particularly for processing operations using new technologies.

Connection to other regimes

AI Act (Reg. EU 2024/1689) Art. 14 — human oversight requirement for high-risk AI systems; explicitly extends GDPR's framework to the development phase. See sources/2023-lazcoz-dehert-humans-in-gdpr-and-aia-governance.
CCPA proposed ADMT rules — opt-out parallel rather than opt-in; see sources/2025-okan-btlj-blog-ccpa-vs-gdpr-automated-decision-making.
DORA + NIS2 do not duplicate Art. 22 but apply on top in regulated sectors — operational-resilience layer over the data-protection layer.

Connections

Concepts: concepts/gdpr-article-22 · concepts/automated-decision-making · concepts/profiling · concepts/human-oversight Related sources (in this wiki): sources/2023-lazcoz-dehert-humans-in-gdpr-and-aia-governance (doctrinal analysis) · sources/2025-okan-btlj-blog-ccpa-vs-gdpr-automated-decision-making (US comparison) · sources/2025-navaie-iapp-engineering-gdpr-compliance-agentic-ai (engineering implementation) Syntheses: syntheses/legal-risk-mapping-ai-process-automation