GDPR Article 22: Automated Decisions

GDPR Article 22 (Automated Decision-Making in Research)

GDPR Article 22(1) gives a data subject 'the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.' A research activity triggers Article 22 only if all three elements hold at once: (1) the decision is made solely by an automated system, with no meaningful human involvement in reaching the specific outcome -- a human merely rubber-stamping an algorithmic output does not count as meaningful involvement, but a human who genuinely reviews the case and can depart from the system's recommendation does; (2) the processing includes profiling or another automated evaluation of the person, not just automated data collection or storage; and (3) the decision produces a legal effect or similarly significant effect on that individual -- something that meaningfully affects their circumstances, behaviour, or choices, not a trivial or cosmetic outcome. In a research context this most commonly arises where an AI/ML system automatically screens, ranks, or excludes real individuals as part of a study -- for example, a clinical-trial-eligibility screening tool that auto-rejects applicants, or an automated participant-selection or risk-stratification algorithm that determines who is invited, enrolled, or offered an intervention -- as opposed to a model that only analyses aggregate or already-anonymised data with no decision made about a specific identifiable person.Article 22(2) narrows this to a qualified right rather than an absolute prohibition: solely automated decisions with legal/significant effect are permitted where (a) necessary for entering into or performing a contract, (b) authorised by Union or Member State law that also lays down suitable safeguards, or (c) based on the data subject's explicit consent. Where (a) or (c) applies, Article 22(3) requires the controller to implement suitable safeguards -- at minimum the right to obtain human intervention, to express a point of view, and to contest the decision. Article 22(4) adds a further restriction: these decisions must not be based on special category data (Article 9(1) -- including data concerning health, which covers most clinical and biomedical research) unless a specific Article 9(2)(a) or (g) exemption applies and suitable safeguards are in place. For research controllers, this means an automated eligibility or selection tool operating on health or genetic data faces a materially higher bar than one operating on non-sensitive data, even where a general Article 6 lawful basis for the underlying processing is otherwise sound.

ByCASRAI Editorial Board

· Last updated 3 Aug 2026

Ask about GDPR Article 22 (Automated Decision-Making in Research)

Answers are drawn from this dictionary entry and the rest of the CASRAI corpus, with a link to every source.

Answers are AI-generated from CASRAI’s own published pages and can be wrong, so check the linked sources before relying on one; your question is logged without personal data — never sold, never used to train a third-party model — to show us what CASRAI is missing, so please do not type personal or confidential details. How we use this

Examples

Worked examples

Is an instance
An AI-based clinical-trial-eligibility screening tool ingests a prospective participant's health records and automatically rejects them as ineligible with no case-by-case human review of individual rejections -- this is a solely automated decision producing a significant effect (exclusion from a trial and its potential benefits) on an identifiable, real individual, and because it operates on health data, it also engages the Article 22(4) special-category restriction.
Is an instance
A university research team uses a machine-learning model to automatically rank and select which members of a recruited cohort receive a scarce follow-up intervention, with the model's output directly determining enrollment and no researcher reviewing individual allocations before they take effect -- this falls within Article 22(1) because the automated ranking alone determines a real-world outcome (who receives the intervention) for identifiable people.

Counter-examples

Looks similar, but isn't

Not an instance
A machine-learning model analyses a fully anonymised, aggregate dataset to identify population-level risk patterns and produces summary statistics with no decision made about, or effect on, any specific identifiable individual -- Article 22 does not apply because there is no 'decision' concerning a data subject, only aggregate analysis.
Not an instance
An automated tool flags candidates as potentially eligible for a study, but a researcher independently reviews each flagged case, has genuine discretion to overrule the flag, and makes the actual enrollment decision -- this is not 'solely' automated processing under EDPB guidance, because there is meaningful human involvement in the specific outcome, even though software assisted the process.

Machine-readable encodings

Use in your systems

JATS XML <role> element

xml

<role vocab="credit"
      vocab-identifier="https://casrai.org/dictionary/"
      vocab-term="GDPR Article 22 (Automated Decision-Making in Research)"
      vocab-term-identifier="https://casrai.org/dictionary/term/gdpr-article-22-automated-decision-making-in-research" />

Schema.org DefinedTerm (JSON-LD)

json

{
  "@context": "https://schema.org",
  "@type": "DefinedTerm",
  "@id": "https://casrai.org/dictionary/term/gdpr-article-22-automated-decision-making-in-research",
  "name": "GDPR Article 22 (Automated Decision-Making in Research)",
  "identifier": "https://casrai.org/dictionary/term/gdpr-article-22-automated-decision-making-in-research",
  "description": "<p>GDPR Article 22(1) gives a data subject 'the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.' A research activity triggers Article 22 only if all three elements hold at once: (1) the decision is made <strong>solely</strong> by an automated system, with no meaningful human involvement in reaching the specific outcome -- a human merely rubber-stamping an algorithmic output does not count as meaningful involvement, but a human who genuinely reviews the case and can depart from the system's recommendation does; (2) the processing includes profiling or another automated evaluation of the person, not just automated data collection or storage; and (3) the decision produces a <strong>legal effect or similarly significant effect</strong> on that individual -- something that meaningfully affects their circumstances, behaviour, or choices, not a trivial or cosmetic outcome. In a research context this most commonly arises where an AI/ML system automatically screens, ranks, or excludes real individuals as part of a study -- for example, a clinical-trial-eligibility screening tool that auto-rejects applicants, or an automated participant-selection or risk-stratification algorithm that determines who is invited, enrolled, or offered an intervention -- as opposed to a model that only analyses aggregate or already-anonymised data with no decision made about a specific identifiable person.</p><p>Article 22(2) narrows this to a qualified right rather than an absolute prohibition: solely automated decisions with legal/significant effect are permitted where (a) necessary for entering into or performing a contract, (b) authorised by Union or Member State law that also lays down suitable safeguards, or (c) based on the data subject's explicit consent. Where (a) or (c) applies, Article 22(3) requires the controller to implement suitable safeguards -- at minimum the right to obtain human intervention, to express a point of view, and to contest the decision. Article 22(4) adds a further restriction: these decisions must not be based on special category data (Article 9(1) -- including data concerning health, which covers most clinical and biomedical research) unless a specific Article 9(2)(a) or (g) exemption applies and suitable safeguards are in place. For research controllers, this means an automated eligibility or selection tool operating on health or genetic data faces a materially higher bar than one operating on non-sensitive data, even where a general Article 6 lawful basis for the underlying processing is otherwise sound.</p>",
  "inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-regulatory#set",
  "url": "https://casrai.org/dictionary/term/gdpr-article-22-automated-decision-making-in-research",
  "sameAs": [],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "publisher": {
    "@id": "https://casrai.org/#organization"
  },
  "dateModified": "2026-08-03T23:02:20",
  "inLanguage": "en"
}