Decisions made solely by automated means, without meaningful human involvement, which the GDPR restricts when they have legal or similarly significant effects.
Article 22 of the GDPR gives people the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal or similarly significant effects, such as automated credit refusal. Exceptions exist but require safeguards like the right to human intervention and to contest the decision.
This overlaps strongly with the EU AI Act, where high-risk systems making such decisions face additional governance and transparency duties.
KaitoSec