Frameworks / GDPR_A22
GDPR Article 22 — Automated individual decision-making
European Data Protection Board · EU · effective 2018-05-25 · GDPR_A22
A person has the right not to be subject to a solely automated decision with legal or similarly significant effect, and to obtain human intervention and contest it.
7 controls, mapped to the evidence that satisfies each
Every control links to the dimension whose evidence would satisfy it. That mapping is the working link between an obligation written in law or a standard and a document somebody has to produce. Each row has its own address: link to a single control.
| Control | Title | Requirement | Satisfied by |
|---|---|---|---|
| Art. 13(2)(f) / 14(2)(g) | Notice of automated decision-making at collection | When personal data is collected, the data subject is told that Article 22(1)/(4) automated decision-making occurs, and given meaningful information about the logic, significance and envisaged consequences. | D1 |
| Art. 15(1)(h) | Right of access to the logic involved | On request, a data subject can obtain meaningful information about the logic, significance and envisaged consequences of automated decision-making concerning them. | D1 |
| Art. 35 | DPIA for high-risk automated decisions | A data protection impact assessment is carried out before processing that includes systematic, extensive, automated evaluation of personal aspects producing legal or similarly significant effects. | D2 |
| Art. 22(4) | Special-category data restriction | A solely automated decision made under the contract or consent exceptions may not be based on special-category data unless explicit consent or substantial public interest applies, with suitable safeguards. | D5 |
| Art. 22(1) | Right not to be subject to a solely automated decision | A person is not subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, unless an Article 22(2) exception applies. | D6 |
| Art. 22(3) | Human intervention, expression of view, contest | Where the contract or consent exception applies, the controller provides at least the right to obtain human intervention, express a view, and contest the decision. | D6 |
| Art. 22(2) | Permitted exceptions | A solely automated decision with such effects is lawful only where necessary for a contract with the data subject, authorised by Union or Member State law, or based on the data subject's explicit consent. | D7 |
What this mapping is, and what it is not
It is a reading of a published instrument, with each control cited to its source, mapped to the kind of evidence that would satisfy it. It is not legal advice, not a certification, and not a statement that any organisation complies with anything. Where an instrument is not yet in force, this page says so rather than selling urgency.
Talk to the person who built this
If you assess clients against this instrument, the mapping is the part you can check line by line. There is no sales team: this is founder-led, so it reaches the founder directly. Tenant access is $500 a month, and free early access to the method, the corpus and the router is on offer first if that is useful. If it is not a fit, saying so costs you one reply.