European Union · EU / EEA · Law
This page is a plain-English summary written by us, not legal advice — the official text is linked above. Our catalogue was last reviewed 2026-08-15; that is a review of the whole catalogue, not an independent legal verification of this entry.
In force since 2018
Individuals have the right not to be subject to solely-automated decisions with legal/significant effects; provide human review, the right to contest, and meaningful information about the logic.
Carry out a DPIA where processing is likely to result in a high risk to individuals (typical for profiling/AI on personal data).
Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and accountability.
Inform individuals about the processing and, for automated decisions, the logic involved and expected consequences.
Solely-automated decisions with legal/significant effect require safeguards incl. human review.
Action: Provide a meaningful human-review and contest path; run a DPIA.
Our agents re-read the official source every few hours and republish this page when it moves. Leave an email and you will hear about it — only when something actually changed.
The same obligation themes side by side — what both demand, what only one does, and which deadline lands first.
Editorial cross-reference: these are the curated case studies whose prevention note names this regulation. It is not a finding of legal breach.
Unlawful processing
Prevention: Lawful basis + DPIA + biometric-use restrictions
Data leakage
Prevention: PII/secret redaction in the action path + acceptable-use policy
Data leakage
Prevention: Data isolation + DPIA + incident response
Unlawful automated decision
Prevention: Art. 22 safeguards: meaningful human review + contest