|

Understanding Automated Decision-Making and Profiling

ByPrivacyiQ

Under Article 22 of the UK GDPR, individuals have rights related to automated decision-making and profiling. Learn how companies should respond.

Article 22 of the UK GDPR gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, if it produces legal or similarly significant effects.

This affects:

  • Credit scoring or loan approvals
  • Automated hiring filters
  • Online behavioural profiling for services or pricing

Where such processing is used, companies must:

  • Inform individuals clearly
  • Provide a human review option
  • Offer a way to contest the decision

đź’ˇ Tip:

Audit your hiring, finance, and marketing systems to identify hidden automation. You may be using profiling without realising it.

Similar Posts

1 of 5: Understanding the Right to Object Under UK GDPR (Article 21)
|

1 of 5: Understanding the Right to Object Under UK GDPR (Article 21)

ByPrivacyiQ

The UK GDPR grants individuals the right to object to certain types of data processing. Learn what Article 21 means for your company and how to stay compliant. Companies today rely on data to drive decision-making, marketing, and operational efficiency. But under the UK General Data Protection Regulation (UK GDPR), individuals have the right to…

Article 13 vs Article 14 of the UK GDPR: What’s the Difference and Why It Matters
|

Article 13 vs Article 14 of the UK GDPR: What’s the Difference and Why It Matters

ByPrivacyiQ

Understand the key differences between Articles 13 and 14 of the UK GDPR, and why your company must tailor privacy notices depending on how personal data is collected. Article 13 vs Article 14 of the UK GDPR: What’s the Difference and Why It Matters Companies often overlook the difference between Article 13 and Article 14…

Verifying Identity Before Fulfilling a GDPR Request
|

Verifying Identity Before Fulfilling a GDPR Request

ByPrivacyiQ

You can ask for ID before fulfilling GDPR requests — but only when necessary. Here’s how to verify identity without breaching privacy. The UK GDPR allows companies to request ID if they have reasonable doubts about the identity of the requester. But be careful — asking for too much ID or failing to protect it…

Children’s Data Rights Under the UK GDPR
|

Children’s Data Rights Under the UK GDPR

ByPrivacyiQ

Children have enhanced data protection rights under UK GDPR. Learn how companies working with under-18s should comply. The UK GDPR gives special protection to children’s personal data. If your company provides services to or collects data from individuals under 18, specific rules apply. Key principles include: These rights tie into the right to be informed,…

The Right to Object: When Can a Company Say No?

The Right to Object: When Can a Company Say No?

ByPrivacyiQ

Article 21 of the UK GDPR gives people the right to object to certain types of data processing. Learn how your company should handle objections. Under Article 21, individuals can object to processing based on: Once someone objects, you must stop processing unless you can demonstrate compelling legitimate grounds that override their interests. đź’ˇ Tip:…

Bushfire in Australia
| |

Retention and Subject Access Requests: What You Don’t Keep Can’t Hurt You

ByPrivacyiQ

Subject access requests are easier (and cheaper) if you delete what you no longer need. Here’s why that’s strategic. Subject access requests (SARs) are rising — and they are expensive. But here’s the secret: the less data you hold, the less you have to search, redact, and disclose. Retention policies don’t just reduce legal risk….