[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F22":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","22","Article 22","Automated individual decision-making, including profiling",63,"General Data Protection Regulation","**What it asks for.** Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Exceptions exist where the decision is necessary for a contract, authorised by law or based on explicit consent, but in the contract and consent cases the controller must provide safeguards, including at least the right to obtain human intervention, express a view and contest the decision.\n\n**In practice.** Organisations identify automated decisions in their processing, assess whether they fall within the article and, where they do, provide meaningful human review and a way to challenge outcomes. Transparency obligations require meaningful information about the logic involved. Evidence includes an inventory of automated decisions, DPIAs and records of human reviews.\n\n**Common gaps.** Human involvement is sometimes nominal, with reviewers who approve outputs without real authority. The use of AI models in hiring, credit or fraud decisions is often not assessed against this article.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_22","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},66,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"surveillance-pricing-bans-highlight-data-monetization-risks","Surveillance Pricing Bans Highlight Data Monetization Risks","2026-11-13T19:20:20.989+00:00",{"slug":24,"title":25,"published_at":26},"ai-governance-platforms-rise-as-eu-ai-act-obligations-force-organizations-to-inventory-and-manage-ai","AI Governance Platforms Rise as EU AI Act Obligations Force Organizations to Inventory and Manage AI Risk","2026-11-13T09:21:16.514+00:00",{"slug":28,"title":29,"published_at":30},"edpb-advances-global-data-protection-standards-and-targets-ai-decision-making-in-2027-enforcement","EDPB Advances Global Data Protection Standards and Targets AI Decision-Making in 2027 Enforcement","2026-11-11T15:20:54.198+00:00",{"slug":32,"title":33,"published_at":34},"ai-chatbots-targeted-by-covert-political-influence-networks","AI Chatbots Targeted by Covert Political Influence Networks","2026-10-15T20:20:35.974+00:00",{"slug":36,"title":37,"published_at":38},"ai-confidence-accuracy-human-oversight-is-non-negotiable-in-forensics","AI Confidence ≠ Accuracy: Human Oversight Is Non-Negotiable in Forensics","2026-10-15T14:21:23.922+00:00",{"slug":40,"title":41,"published_at":42},"unauthorised-ai-agent-actions-expose-gaps-in-governance-and-oversight","Unauthorised AI Agent Actions Expose Gaps in Governance and Oversight","2026-10-14T18:22:00.668+00:00",{"slug":44,"title":45,"published_at":46},"ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","2026-10-14T10:20:18.748+00:00",{"slug":48,"title":49,"published_at":50},"ai-agents-are-the-new-bec-target-social-engineering-evolves","AI Agents Are the New BEC Target: Social Engineering Evolves","2026-10-09T14:20:26.055+00:00",{"slug":52,"title":53,"published_at":54},"mathematical-formula-reveals-ai-chatbot-rogue-output-tipping-points","Mathematical Formula Reveals AI Chatbot 'Rogue Output' Tipping Points","2026-10-09T06:20:39.603+00:00",{"slug":56,"title":57,"published_at":58},"ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","2026-10-08T16:21:43.317+00:00",{"slug":60,"title":61,"published_at":62},"uber-fined-825m-for-opaque-automated-driver-deactivations","Uber Fined €825M for Opaque Automated Driver Deactivations","2026-10-08T14:20:56.047+00:00",{"slug":64,"title":65,"published_at":66},"agentic-ai-escapes-guardrails-exposing-legal-blind-spots","Agentic AI Escapes Guardrails, Exposing Legal Blind Spots","2026-10-02T18:20:24.469+00:00",[68,73,78,83,88,92],{"slug":69,"name":70,"problem":71,"stories":72},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",24,{"slug":74,"name":75,"problem":76,"stories":77},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",12,{"slug":79,"name":80,"problem":81,"stories":82},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",11,{"slug":84,"name":85,"problem":86,"stories":87},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",6,{"slug":89,"name":90,"problem":91,"stories":87},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":93,"name":94,"problem":95,"stories":96},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",3,[98,103,108,114,119,123,128,133],{"family":99,"item":100,"code":101,"title":101,"together":102},"itil","overview","ITIL",41,{"family":104,"item":100,"code":105,"title":106,"together":107},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",38,{"family":109,"item":110,"code":111,"title":112,"together":113},"cis","3","Control 3","Data Protection",35,{"family":115,"item":100,"code":116,"title":117,"together":118},"nist-privacy","Privacy Framework","NIST Privacy Framework",26,{"family":5,"item":120,"code":121,"title":122,"together":72},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":5,"item":124,"code":125,"title":126,"together":127},"5","Article 5(1)(f)","Principles relating to processing of personal data",21,{"family":109,"item":129,"code":130,"title":131,"together":132},"8","Control 8","Audit Log Management",20,{"family":134,"item":135,"code":136,"title":137,"together":138},"iso","42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system",19]