GDPR Article 22: Exceptions, Consent, and Penalties

GDPR Article 22 gives every person in the EU the right not to be subject to a decision based solely on automated processing when that decision produces legal effects or similarly significantly affects them.¹ For organizations running algorithms that approve loans, screen job applicants, price insurance, or filter benefit claims, the rule sets a hard default: a human with real authority must be in the loop, unless one of three narrow exceptions applies. Violations sit in the GDPR’s top penalty tier, with fines up to €20 million or 4 percent of worldwide annual turnover.²

When the Rule Actually Applies

Two conditions have to be met together. The decision must be based solely on automated processing, and it must produce legal effects or similarly significantly affect the individual.

“Solely” carries the weight. If a person reviews the algorithm’s output, considers the underlying data, and has genuine authority to change the result, the decision is no longer solely automated and Article 22 does not apply. A reviewer who clicks “approve” on whatever the model outputs adds nothing, and supervisory authorities look at whether independent judgment was actually exercised.

Profiling, defined by the GDPR as any automated use of personal data to evaluate aspects of a person such as work performance, economic situation, health, preferences, reliability, behavior, or location, is not banned on its own.³ Article 22 targets profiling and other automated processing when it drives a decision without meaningful human involvement.

Legal effects change someone’s formal legal position: denial of a benefit, cancellation of a contract, refusal of citizenship. “Similarly significant” effects do not change legal rights but still meaningfully shape a person’s life. An automated credit rejection that locks someone out of financing, or a recruitment filter that removes a candidate before any human sees the application, both clear that bar. Routine personalization such as product recommendations or feed ordering typically does not.

Who Has to Comply

Article 22 reaches well beyond EU-based companies. Under the GDPR’s territorial scope, any organization that offers goods or services to people in the EU, or monitors their behavior within the EU, falls under the regulation regardless of where it is headquartered.⁴ A U.S. fintech running an automated credit-scoring algorithm on German applicants is bound by Article 22 the same way a Berlin bank would be.

The Three Exceptions

A solely automated decision with legal or significant effects is permitted only when one of these grounds applies:¹

The decision is necessary to enter into or perform a contract with the individual. Instant loan approvals that must run in real time can fit here, but only if the automation is genuinely necessary for the contract rather than just convenient for the controller.
EU or Member State law authorizes the processing and lays down suitable safeguards. Tax fraud detection and anti-money-laundering screening often sit on this basis.
The individual has given explicit consent. This is a higher bar than ordinary GDPR consent.

Contract necessity and explicit consent unlock the processing but not the obligations. The controller still owes the individual the safeguards described below.

Why Explicit Consent Is a Higher Bar

A ticked box acknowledging a privacy policy will not carry Article 22. Explicit consent requires an express statement of agreement, and the person must specifically understand that a fully automated system will make a decision with significant personal consequences.⁵

The European Data Protection Board points to signed forms, digital forms with clear “Yes” and “No” checkboxes, or emails with verification links as workable methods. Vague language such as “It is clear to me that my data will be processed” does not qualify; wording along the lines of “I consent to this decision being made entirely by an automated system” does. Controllers should keep evidence that consent was obtained before processing begins.

Sensitive Data: An Extra Layer

Automated decisions generally cannot rely on special categories of personal data at all: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health information, or data about sex life or sexual orientation.⁶

Only two grounds override that prohibition: the individual’s explicit consent to the use of the sensitive data, or processing necessary for reasons of substantial public interest under EU or Member State law that includes specific safeguards. Even then, suitable measures to protect the individual’s rights must be in place.¹ A health insurer feeding diagnostic data into an automated underwriting model needs both a valid basis for the health data and defenses against discriminatory outcomes.

Children

Article 22 does not set separate rules for children, but Recital 71 states that automated decision-making with legal or significant effects “should not concern a child.” Regulatory guidance treats that as a strong presumption against subjecting minors to purely algorithmic decisions with real consequences, and advises controllers to avoid relying on the Article 22(2) exceptions where possible.⁷ When automated decisions about children do go ahead, the safeguards must be child-friendly and easy to access, children have an absolute right to object to profiling for direct marketing, and a Data Protection Impact Assessment is required.

What You Owe the Individual

Transparency runs through several articles. When personal data is collected directly, the controller must disclose the existence of automated decision-making, provide meaningful information about the logic involved, and explain the significance and expected consequences of the processing.⁸ The same disclosure is owed when the data comes from another source.⁹ Individuals can also request this information at any time through a subject access request under Article 15.¹⁰

“Meaningful information about the logic” does not mean handing over source code. It means telling the person which factors the system considers, roughly how they weigh, and how they shape the outcome. If a credit model treats payment history as more decisive than income, that is the kind of thing the individual is entitled to know.

Where a controller relies on contract necessity or explicit consent, three specific safeguards apply:¹

Human intervention on request, from a reviewer with full access to the relevant data and genuine authority to change the result.
The ability to express a point of view, so the individual can correct inaccuracies or explain circumstances the model missed.
The right to contest the decision through a clearly explained appeal route.

Burying the appeal path in fine print, or routing reviews to someone without authority to reverse the algorithm, does not meet these obligations.

Data Protection Impact Assessments

Before deploying an automated decision-making system with legal or significant effects, controllers must complete a Data Protection Impact Assessment. Article 35 requires a DPIA for any systematic and extensive evaluation of personal aspects based on automated processing, including profiling, where the results drive decisions producing legal or similarly significant effects.¹¹

EDPB guidelines identify evaluation or scoring and automated decision-making with legal or significant effects among the criteria for high-risk processing, and processing meeting two or more of those criteria generally requires a DPIA.¹² Most Article 22 systems will hit both by definition. The assessment should identify the risks to individuals, evaluate proportionality, and document mitigations, and it should be revisited when the system, inputs, or observed outcomes change.

The EU AI Act Sits Alongside, Not Instead

The EU AI Act, which began applying in stages starting in 2025, adds a parallel set of obligations to many systems that also fall under Article 22. High-risk AI systems must be designed for effective human oversight, and deployers of high-risk systems that make or assist decisions about individuals must inform those individuals that they are subject to the system. This overlaps with GDPR transparency under Articles 13, 14, and 15 without replacing it. Organizations should expect to comply with both frameworks at once: the GDPR governs the individual’s data protection rights, while the AI Act addresses system design, risk management, and deployment.

Penalties

Infringements of data subject rights under Articles 12 through 22 fall under Article 83(5), which caps fines at €20 million or 4 percent of total worldwide annual turnover from the preceding financial year, whichever is higher.² That ceiling covers the whole Article 22 framework: prohibited automated decisions, missing safeguards, withheld transparency, and sensitive-data processing without a valid basis.

Money is not the only exposure. Supervisory authorities can order controllers to bring processing into compliance, impose temporary or permanent bans on the automated processing, and require notice to affected individuals. For a business whose product depends on algorithmic decisions, an order to stop that processing can bite harder than any fine.

1
General Data Protection Regulation (GDPR). GDPR Article 22 – Automated Individual Decision-Making, Including Profiling
2
General Data Protection Regulation (GDPR). GDPR Article 83 – General Conditions for Imposing Administrative Fines
3
General Data Protection Regulation (GDPR). GDPR Article 4 – Definitions
4
General Data Protection Regulation (GDPR). GDPR Article 3 – Territorial Scope
5
European Data Protection Board. Guidelines 05/2020 on Consent Under Regulation 2016/679
6
General Data Protection Regulation (GDPR). GDPR Article 9 – Processing of Special Categories of Personal Data
7
Information Commissioner’s Office. What If We Want to Profile Children or Make Automated Decisions About Them?
8
General Data Protection Regulation (GDPR). GDPR Article 13 – Information to Be Provided Where Personal Data Are Collected From the Data Subject
9
General Data Protection Regulation (GDPR). GDPR Article 14 – Information to Be Provided Where Personal Data Have Not Been Obtained From the Data Subject
10
General Data Protection Regulation (GDPR). GDPR Article 15 – Right of Access by the Data Subject
11
GDPR.eu. Article 35 GDPR – Data Protection Impact Assessment
12
European Data Protection Board. Data Protection Impact Assessments – High Risk Processing