GDPR Article 22 — Automated Individual Decision-Making
Article 22 of the EU General Data Protection Regulation gives data subjects the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning them or similarly significantly affects them. The right applies across the EU and EEA and has been in force since May 25, 2018. The European Data Protection Board's Guidelines 1/2024 (adopted December 2024) clarify the scope, including how it applies to large language models and recommender systems. The CJEU's SCHUFA ruling (Case C‑634/21, December 2023) confirmed that automated credit scoring constitutes a "decision" under Article 22 where the score effectively determines whether a loan or contract is granted. Enforcement is by national Data Protection Authorities; penalties for Article 22 violations fall under the GDPR's higher tier — up to €20 million or 4% of worldwide annual turnover.
Jurisdiction
EU
Enforcement
May 25, 2018
Maximum penalty
Up to €20M or 4% of global annual turnover
Key obligations
- 01Identify any processing operation that produces a decision based solely on automated means and that has legal or similarly significant effects on a natural person.
- 02Establish a lawful basis under Article 22(2): explicit consent, necessity for performance of a contract, or specific Member-State or Union law authorisation.
- 03Provide meaningful information about the logic, significance, and envisaged consequences of the automated decision (Articles 13(2)(f), 14(2)(g), 15(1)(h)).
- 04Implement suitable safeguards: at minimum the right to obtain human intervention, to express a point of view, and to contest the decision.
- 05Carry out a Data Protection Impact Assessment (DPIA) where the processing is likely to result in high risk to the rights and freedoms of natural persons.
- 06Apply heightened protections for special-category data (Article 9) and for children — processing of these populations triggers tighter restrictions.
- 07Maintain Records of Processing Activities (Article 30) that document automated decision-making logic, safeguards, and review cadence.
Vendors that support GDPR Art. 22
Sorted by coverage level. Full coverage shown first.
22 vendors
| Vendor | HQ | Founded | Size | Pricing | Coverage | Last checked |
|---|---|---|---|---|---|---|
| Scrut Automation | Palo Alto, United States | 2021 | 51-200 | Contact for pricing | Comprehensive | Sep 21, 2026 |
| Braintrust | San Francisco, United States | 2023 | 51-200 | Starter free ($0/mo, 1GB data/10k scores incl., overage $4/GB $2.50/1k); Pro $249/mo (5GB/50k incl., overage $3/GB $1.50/1k); Enterprise custom. | Comprehensive | Sep 21, 2026 |
| Aporia | San Jose, United States | 2019 | 51-200 | Enterprise pricing only. Not publicly listed. | Comprehensive | Apr 27, 2026 |
| Luminos.Law (ZwillGen AI Division) | Washington, DC, United States | 2019 | 51-200 | Contact for pricing | Partial | Oct 1, 2026 |
| ServiceNow AI Control Tower | Santa Clara, United States | 2004 | 1000+ | Contact for pricing | Partial | Sep 21, 2026 |
| Securiti Data Command Center | San Jose, United States | 2018 | 501-1000 | Contact for pricing | Partial | Oct 1, 2026 |
| BigID | New York, United States | 2016 | 501-1000 | Contact for pricing | Partial | Sep 21, 2026 |
| TrustArc | Walnut Creek, United States | 1997 | 501-1000 | Enterprise subscription; contact sales for quote; modular pricing based on scope and modules | Partial | Sep 21, 2026 |
| Naaia | Louveciennes, France | 2021 | 11-50 | No public pricing tiers; demo and quote requested via website. | Partial | Sep 21, 2026 |
| DeepKeep | Israel | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| QL Security | United Kingdom | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| ComplyAgent | European Union | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| LearnWize | Netherlands | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| PrivacyScrubber | United States | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| SetAIComply | European Union | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| AIMS by Workflo | Hungary | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| LandingRed | Italy | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| Meilynx | United States | — | — | Contact for pricing | Partial | Sep 21, 2026 |
| BABL AI | Iowa City, United States | 2018 | 11-50 | Contact for pricing | Adjacent | Sep 21, 2026 |
| 2021.AI | Copenhagen, Denmark | 2016 | 51-200 | Pricing is custom and tailored to use case, organization size, deployment model (on-prem or cloud), and selected modules. Contact sales required per their pricing page. | Adjacent | Sep 21, 2026 |
| Drata | United States | 2020 | — | GRC plans (Foundation, Advanced, Enterprise) and Assurance plans (Trust Center and questionnaires) are quoted; drata.com shows no prices. Its AWS Marketplace listing charges a $25,000 platform fee for a 100-FTE organization plus $7,500 per framework, for a 12-month contract. | Adjacent | Oct 15, 2026 |
| Vanta | San Francisco, United States | 2018 | 501-1000 | Four plans: Essentials, Plus, Professional and Enterprise. No prices on vanta.com; its AWS Marketplace listing gives 12-month starting prices for 1-20 employees: Essentials $14,000, Plus $21,500, Professional $23,000. Enterprise is quoted. Third-party risk management is a separate product ($13,600 a year for up to 50 vendors on AWS). | Adjacent | Oct 15, 2026 |
Frequently asked
In-depth answers about GDPR Art. 22.
Compare across industries
See which vendors support GDPR Art. 22 in your sector.
Last reviewed April 28, 2026. Informational summary only — not legal advice. Consult qualified counsel for specific obligations.