AI Governance Engineer
GitHub

GDPR Art. 22: solely automated decisions and their safeguards

A right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, except on contract, law or explicit consent; then human intervention, the right to express a view and to contest (Art. 22(3))

By Reviewed

From clause to evidenceThe chain from GDPR Art. 22 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseGDPRArt. 22Duty holderControllerApplies from2018-05-25In forceArtefactDecision recordwith reason…LayersLayer 04Layer 05Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from GDPR Art. 22 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.ClauseGDPR · Art. 22Duty holderControllerApplies from2018-05-25 · In forceArtefactDecision record with reason…LayersLayer 04Layer 05Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-GDPR-ART22. Drawn from chapter 08.
Text alternative
  • Clause: GDPR, Art. 22.
  • Duty holder: Controller.
  • Applies from: 2018-05-25, In force.
  • Artefact: Decision record with reason….
  • Layers: Layer 04, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
Id
AIGE-OBL-GDPR-ART22
Instrument
General Data Protection Regulation (EU) 2016/679 law
Clause
Art. 22
In scope
Controller
Authority
National data protection authority
Applies from
In force

The artefact that evidences it

Decision record with reason codes; contest channel and human review log; appeal outcomes by group.

Patterns that build it

Source

Chapter 08, section The GDPR, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). GDPR Art. 22: solely automated decisions and their safeguards (AIGE-OBL-GDPR-ART22). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art22. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{GDPR Art. 22: solely automated decisions and their safeguards (AIGE-OBL-GDPR-ART22)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-gdpr-art22},
  note         = {Version 0.5.0}
}