GDPR Art. 22 vendors for Financial Services
Vendors that support GDPR Article 22 — Automated Individual Decision-Making and explicitly serve financial services customers. Each vendor’s last-checked date is shown in the table.
| Vendor | HQ | Founded | Size | Pricing | Last checked |
|---|---|---|---|---|---|
| Scrut Automation | Palo Alto, United States | 2021 | 51-200 | Contact for pricing | Sep 21, 2026 |
| Luminos.Law (ZwillGen AI Division) | Washington, DC, United States | 2019 | 51-200 | Contact for pricing | Oct 1, 2026 |
| Securiti Data Command Center | San Jose, United States | 2018 | 501-1000 | Contact for pricing | Oct 1, 2026 |
| BigID | New York, United States | 2016 | 501-1000 | Contact for pricing | Sep 21, 2026 |
| Aporia | San Jose, United States | 2019 | 51-200 | Enterprise pricing only. Not publicly listed. | Apr 27, 2026 |
| Naaia | Louveciennes, France | 2021 | 11-50 | No public pricing tiers; demo and quote requested via website. | Sep 21, 2026 |
| 2021.AI | Copenhagen, Denmark | 2016 | 51-200 | Pricing is custom and tailored to use case, organization size, deployment model (on-prem or cloud), and selected modules. Contact sales required per their pricing page. | Sep 21, 2026 |
| PrivacyScrubber | United States | — | — | Contact for pricing | Sep 21, 2026 |
| Meilynx | United States | — | — | Contact for pricing | Sep 21, 2026 |
| Drata | United States | 2020 | — | GRC plans (Foundation, Advanced, Enterprise) and Assurance plans (Trust Center and questionnaires) are quoted; drata.com shows no prices. Its AWS Marketplace listing charges a $25,000 platform fee for a 100-FTE organization plus $7,500 per framework, for a 12-month contract. | Oct 15, 2026 |
About GDPR Art. 22
Article 22 of the EU General Data Protection Regulation gives data subjects the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning them or similarly significantly affects them. The right applies across the EU and EEA and has been in force since May 25, 2018. The European Data Protection Board's Guidelines 1/2024 (adopted December 2024) clarify the scope, including how it applies to large language models and recommender systems. The CJEU's SCHUFA ruling (Case C‑634/21, December 2023) confirmed that automated credit scoring constitutes a "decision" under Article 22 where the score effectively determines whether a loan or contract is granted. Enforcement is by national Data Protection Authorities; penalties for Article 22 violations fall under the GDPR's higher tier — up to €20 million or 4% of worldwide annual turnover.
Read framework guide →About Financial Services
Banking, lending, insurance, and capital markets firms deploying AI for credit decisioning, fraud detection, underwriting, algorithmic trading, and customer service. Subject to heavy sector-specific oversight (OCC, FRB, CFPB, FCA, EBA) layered on top of horizontal AI regulations.
See all financial services vendors →