Short answer
Article 22 GDPR applies when three conditions are present: there is a decision about a person, it is based solely on automated processing, and it produces a legal effect or a similarly significant effect. The assessment is functional. Calling an algorithm's output a recommendation does not avoid Article 22 if a human does not genuinely assess it, or if a downstream organisation relies so strongly on a score that it effectively determines the result.
Such decision-making is prohibited in principle unless it is necessary for a contract, authorised by EU or Member State law that provides safeguards, or based on explicit consent. Even then, the controller needs an ordinary GDPR lawful basis and must provide information and safeguards. Human review must be real: a competent person should consider the individual's explanation and relevant data, understand the reasons for the result, and have authority to change it. The person must be able to express a view and contest the outcome.
The three-part Article 22 test
Article 22(1) provides:
“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.” —
The Court of Justice confirmed in SCHUFA Holding (Scoring) that the provision has three cumulative conditions: a decision, sole reliance on automated processing, and the required effect. Profiling and Article 22 overlap, but they are not identical. Profiling is automated evaluation of personal aspects. It becomes an Article 22 decision only when all three conditions are met.
What is a decision?
“Decision” is broad and covers measures that determine or materially shape an outcome. In SCHUFA, a credit agency generated an automated probability value and sent it to a bank. Although the bank formally decided the credit application, the score qualified as a decision where the bank drew strongly on it and a low score led in almost all cases to refusal.
This prevents responsibility being divided artificially between a scoring provider and the organisation acting on the score. It does not mean every risk indicator, ranking or recommendation is independently a decision. The practical question is how much it determines the later action.
When is processing “solely” automated?
A process is not solely automated where a person makes a genuine, independent assessment before the result affects the individual. The says fabricated involvement does not avoid Article 22: the reviewer needs authority and competence to change the decision and must consider the relevant data. Merely clicking approve or following an algorithm by default is unlikely to qualify.
Controllers should examine actual practice: Does the reviewer receive the relevant information rather than only the score? Can they depart from it? Are they trained and given time to evaluate the case? How often are results changed? An organisation cannot rely only on a policy saying “human in the loop” if the workflow makes disagreement impossible or purely ceremonial.
Automation may still be subject to the GDPR outside Article 22. The controller still needs a lawful basis, transparency, data minimisation, accuracy, security and fair-processing controls.
What effects are significant enough?
A legal effect changes a person's rights, legal status or contractual position—for example, termination of a contract, refusal of a benefit or denial of a legal entitlement. A similarly significant effect need not alter formal legal rights but must comparably affect the person's circumstances, behaviour, choices or opportunities.
Recital 71 gives automatic refusal of an online credit application and automated e-recruitment as examples. Other likely contexts include access to housing, education, insurance, healthcare or essential services, depending on impact. A minor recommendation or ordinary advertisement will not usually be enough, but persistent targeting that exploits vulnerability or materially restricts opportunities may require a closer factual assessment. Scale alone does not replace the individual-effects test.
When may a solely automated decision be made?
Article 22(2) supplies only three routes:
- it is necessary for entering into or performing a contract with the individual;
- it is authorised by EU or Member State law that also lays down suitable safeguards; or
- it is based on the individual's explicit consent.
Contractual convenience is insufficient. Necessity asks whether the contractual purpose can reasonably be achieved through a less intrusive process. Authorising law must apply to the controller and provide safeguards, not merely permit data processing in general. Explicit consent must meet the GDPR's requirements for a specific, informed, unambiguous and freely given affirmative choice and be capable of withdrawal.
An exception to Article 22 does not itself provide everything required for lawful processing. Article 5 principles and an Article 6 basis still apply. Decisions using special-category data are restricted further: Article 22(4) permits them only in the specified explicit-consent or substantial-public-interest circumstances, with suitable measures.
What must human intervention look like?
For contract- and consent-based decisions, Article 22(3) requires suitable safeguards, including:
“at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.” —
Authorising legislation must likewise lay down suitable measures. A defensible review process should let the person know how to request review, correct input data, explain circumstances the model missed and challenge the reasoning or outcome. The reviewer should have access to the relevant inputs and rationale, sufficient competence and authority, and freedom from incentives that turn review into automatic confirmation.
The result need not always change. What matters is that the review can change it after an individual assessment. The controller should document the request, material considered, reviewer's reasoning and final communication. Quality checks should test override rates, recurring errors, discriminatory outcomes and whether review is timely enough to be useful.
What explanation must be provided?
Articles 13 and 14 require notice of relevant automated decision-making, meaningful information about the logic involved, and the significance and envisaged consequences. Article 15(1)(h) gives a corresponding access right.
In Dun & Bradstreet Austria, the Court held that meaningful information must explain the procedure and principles actually applied, using relevant information in a concise, transparent, intelligible and accessible form. The explanation should allow the person to understand which personal data were used and how they produced the particular result. A sensitivity example—showing how changing relevant inputs would have changed the score—may help.
Neither extreme is sufficient. The Court said that merely communicating a complex mathematical formula or describing every technical step would not provide the required concise and intelligible explanation. The GDPR therefore does not impose a general demand to hand over source code, but “trade secret” is not a blanket refusal. Where protected third-party data or trade secrets are genuinely involved, a supervisory authority or court may need to balance the competing rights and determine the proper extent of access.
An explanation supports, rather than replaces, human review. The person needs enough information to identify errors, make relevant representations and challenge the outcome effectively.
A practical audit checklist
- What act or output is the decision, and which organisation makes it?
- Does a score or recommendation effectively determine a later decision?
- What does the human reviewer actually see, assess and have power to change?
- Does the outcome alter rights or produce a comparably serious practical effect?
- Which Article 22(2) exception applies, and what evidence proves its conditions?
- What Article 6 basis and additional Article 9 condition, if needed, apply?
- Can the person obtain timely human intervention, express a view and contest?
- Does the explanation describe the data, procedure, principles and consequences intelligibly?
- Are accuracy, bias, security, error correction and review effectiveness monitored?
Conclusion
Article 22 looks through labels to practical decision power and impact. An automated score may qualify even before the formal final act when another organisation relies strongly on it. Conversely, genuine independent human judgment can take a process outside the “solely automated” condition, though ordinary GDPR duties remain. Where an Article 22 exception permits the decision, meaningful review and explanation are operational rights: the person must be able to understand the result, present their case and obtain a competent reconsideration that can make a difference.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.