Eleanor VaughanTL;DR: GDPR Article 22 gives you a qualified right not to be subjected to a purely automated decision — including AI-driven credit scoring, job screening, or benefits assessments — that produces legal effects or similarly significant impacts on your life. You can demand human review, express your position, and formally contest the outcome. This guide explains the four rights Article 22 grants you, the three lawful bases that allow automated decisions, and five concrete steps to challenge any AI-driven outcome in 2026.
What GDPR Article 22 Actually Covers
Article 22 of the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679) establishes a fundamental right: no person should be subject to a decision based solely on automated processing when that decision produces a legal effect or a similarly significant effect on them. The regulation came into force on 25 May 2018 and applies across all 27 EU member states, the EEA, and — through the UK GDPR — the United Kingdom after Brexit.
The scope is deliberately broad. A "legal effect" is straightforward: a loan refusal, a tenancy denial, a visa rejection. A "similarly significant effect" reaches further — job application screening that never routes your CV to a human recruiter, insurance pricing that bars you from coverage, or a fraud-detection algorithm that freezes your bank account. The European Data Protection Board (EDPB) confirmed in its Guidelines on Automated Decision-Making (WP251/05-2022) that the test is functional: does the decision materially alter your circumstances?
Automated Processing vs. Human Involvement: The Critical Line
Article 22 applies only where the decision is made solely by automated means. Where a human genuinely reviews the automated output and exercises independent judgment — not simply rubber-stamping an algorithm's recommendation — Article 22's prohibition does not automatically engage. However, EDPB guidance makes clear that token human involvement does not satisfy the exception: the human review must be "meaningful." A customer service agent who can only confirm an algorithm's outcome, without the authority or information to override it, does not constitute meaningful human involvement.
The Three Lawful Bases for Automated Decisions
Article 22(1) establishes a general prohibition, but Article 22(2) carves out three exceptions where automated decisions are lawful. Each comes with mandatory safeguards that controllers — the organisations processing your data — must implement.
| Lawful Basis | Condition | Mandatory Safeguards |
|---|---|---|
| Contract necessity | The automated decision is necessary to enter into or perform a contract with you | Right to obtain human intervention; right to express your view; right to contest |
| Authorised by EU/Member State law | A specific legal provision expressly authorises automated processing and includes its own protective measures | As specified in the authorising law, plus the general GDPR safeguards framework |
| Explicit consent | You have given freely, specific, informed, and unambiguous consent to the automated processing | Right to withdraw consent at any time; same human intervention, expression, and contestation rights |
One important constraint: the lawful basis for special category data — health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and genetic data — is even stricter. Automated decisions based on special categories can only be made under bases (1) or (3), not (2), and only with additional explicit consent or where substantial public interest applies [GDPR Art. 22(4), 2016].
Your Four Core Rights Under Article 22
When an automated decision covered by Article 22 is made about you — whether or not it falls within one of the lawful exceptions — the following rights are activated. These rights are not optional extras. Where an exception applies and the controller proceeds with automated processing, GDPR Art. 22(3) makes all four protections mandatory.
1. The right to obtain human intervention. You can require that a human being with appropriate authority review the automated decision. That person must have access to the information the algorithm used and the ability to change the outcome — not just document your request.
2. The right to express your point of view. Before a final decision is issued, or as part of a review, you have the right to present facts, context, or additional evidence the algorithm could not assess. For example, if an automated income-verification system missed a recent pay rise, you can supply payslips directly.
3. The right to an explanation. Under GDPR Articles 13, 14, and 22 read together, you are entitled to meaningful information about the logic involved, the significance of the processing, and the envisaged consequences. The explanation must be specific enough to allow you to understand and challenge the outcome — not a generic description of the model type.
"The controller must be able to explain, in clear and plain language, why the algorithm reached its conclusion and what factors carried the most weight," states the EDPB Guidelines on Automated Decision-Making [EDPB, 2022]. Opacity in the model is not a defence.
4. The right to contest the decision. If you disagree with the automated outcome — or with the explanation provided — you have the right to formally contest it. Contestation triggers a duty on the controller to re-examine the decision under human oversight. Fines for non-compliance can reach €20 million or 4% of total annual worldwide turnover — whichever is higher [GDPR Art. 83, 2016].
How to Challenge an Automated Decision: 5 Practical Steps
The rights above only have value if you exercise them. Here is a structured process for challenging an automated decision in 2026.
Step 1 — Confirm the decision is purely automated and has significant effects. Check the controller's privacy notice or Article 13/14 information. GDPR requires controllers to proactively disclose when automated decision-making is in use. If the notice is silent or vague, make a Subject Access Request (SAR) under Article 15. The SAR response must confirm whether automated processing occurred and explain the logic involved.
Step 2 — Send a written Article 22 request to the controller. Write to the controller's data protection contact — usually the Data Protection Officer (DPO) if one exists. State explicitly: "I am invoking my rights under Article 22 GDPR. I request human review of the automated decision made on [date], a written explanation of the logic and factors applied, the opportunity to express my point of view, and a formal contestation of the outcome." Send by email (with delivery receipt) or recorded post.
Step 3 — Provide your supporting evidence. Attach or describe any information that contradicts the automated conclusion. The controller must consider this evidence during the human review.
Step 4 — Record the controller's response and deadlines. Controllers must respond to a SAR within one calendar month [GDPR Art. 12(3)], extendable by two further months for complex cases. An Article 22 request should be treated with equivalent urgency. If the deadline passes without a substantive response, note the date — this is a breach you can report.
Step 5 — Escalate if unsatisfied. If the controller refuses, fails to respond, or provides an inadequate explanation, you have two parallel routes. First, file a complaint with your national data protection supervisory authority — the ICO in the UK, the CNIL in France, the BfDI in Germany, or the relevant authority in your country. Second, you may bring a civil claim for non-material damage under Article 82 GDPR, which provides compensation for loss of control over your data or for demonstrable harm caused by the automated decision.
À retenir: Send your Article 22 request in writing, reference the specific GDPR article, and preserve every communication. Supervisory authorities need a documented paper trail to investigate your complaint effectively.
The Role of Supervisory Authorities and DPOs
Every EU member state has a designated supervisory authority responsible for enforcing GDPR. In the UK, the Information Commissioner's Office (ICO) performs this function. These bodies have investigative powers — including access to premises, systems, and processing records — and can impose binding corrective measures on controllers.
A Data Protection Officer (DPO) is a mandatory appointment for controllers whose core activities involve systematic, large-scale processing of personal data or special category data. The DPO must be accessible to data subjects and act as an internal compliance point. When you invoke Article 22 rights, addressing your initial request to the DPO is often faster than general customer service channels — the DPO has a statutory obligation to respond.
If you cannot identify a DPO, the controller's general data protection contact is published in the privacy notice. Where a controller operates in multiple EU countries, the "one-stop-shop" mechanism of GDPR may direct your complaint to the supervisory authority in the country where the controller has its main establishment. For pan-European platforms — social networks, credit bureaus, insurance aggregators — this is typically Ireland (Data Protection Commission), Luxembourg (CNPD), or the Netherlands (AP).
Supervisory authorities can impose fines, order deletion of data, and require controllers to redesign their automated systems. Filing a complaint costs nothing and is available to any data subject regardless of their nationality.
GDPR Article 22 and the EU AI Act in 2026
The EU AI Act (Regulation 2024/1689), which reached full application in August 2026, significantly reinforces the Article 22 framework without replacing it. The AI Act designates certain AI systems as "high-risk" — including AI used for creditworthiness assessment, employment decisions, benefits administration, and biometric identification. High-risk systems must meet mandatory transparency, accuracy, and human oversight requirements before deployment.
The interaction with GDPR Article 22 is direct. Where a high-risk AI system contributes to an automated decision covered by Article 22, the controller faces a dual compliance burden. GDPR Article 22 governs the individual's right to challenge the decision. The AI Act separately imposes obligations on the system's design, documentation, and ongoing monitoring. Data Protection Impact Assessments (DPIAs) required under GDPR Article 35 must now also consider AI Act conformity assessments.
In practice, 2026 represents a stricter environment for automated decision-making than at any previous point. Controllers who deployed AI-driven scoring or screening systems and relied on contract necessity as their Article 22 basis should review whether those systems qualify as high-risk under the AI Act. They should also confirm whether their existing human oversight mechanisms meet the stronger "meaningful human oversight" standard now expected under the combined regulatory framework.
For individuals, the practical effect is increased leverage: an Article 22 challenge can now be paired with an AI Act complaint to the relevant market surveillance authority, strengthening the case for systemic correction rather than just individual remedy.
Frequently Asked Questions
Does Article 22 apply to AI-assisted decisions where a human also signs off?
Not automatically. Article 22 applies to decisions based "solely" on automated processing. If a human genuinely reviews the automated output with authority to override it — and has access to sufficient information to do so meaningfully — then the decision is not solely automated. However, the EDPB is clear that rubber-stamp approvals do not qualify: the human reviewer must exercise real judgment, not simply confirm the algorithm's output [EDPB WP251, 2022].
Can I invoke Article 22 if I only suspect a decision was automated?
Yes. File a Subject Access Request (SAR) under Article 15 and explicitly ask whether automated decision-making was used and the logic behind any such processing. The controller must answer this as part of the SAR response within one month. The answer gives you the factual basis for an Article 22 challenge.
What if the organisation says my data is anonymised or aggregated and Article 22 does not apply?
GDPR applies to personal data — information relating to an identified or identifiable individual. If the output of processing identifies you and produces a decision affecting you, anonymisation of intermediate steps does not remove your Article 22 rights. Challenge this reasoning directly with the controller's DPO and, if unsatisfied, refer the question to your supervisory authority.
Does UK GDPR provide the same Article 22 rights after Brexit?
Yes. The UK GDPR, as retained and amended by the Data Protection Act 2018, mirrors GDPR Article 22 in full. The ICO enforces these rights in the UK. The only material difference is that post-Brexit, cross-border complaints between the UK and EU may require parallel filings with both the ICO and the relevant EU supervisory authority.
Legal Disclaimer: The information in this article is provided for general informational purposes only and does not constitute legal advice. GDPR compliance requirements and enforcement practices may vary by jurisdiction and evolve over time. Consult a qualified data protection lawyer or privacy consultant for advice specific to your situation.
