Q&As

How do we respond to customers who question or challenge us in relation to automated decision making?

read titleRead full title
Copyright © 2025 LexisNexis
Published by a LexisNexis Risk & Compliance expert
Published on: 23 February 2022
imgtext

Article 22(1) of the United Kingdom General data protection Regulation (UK GDPR), Assimilated Regulation (EU) 2016/679 gives data subjects the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects that concern them or similarly significantly affects them.

Article 22(1) of the UK GDPR does not apply (ie automated decision making is allowed) in certain specified circumstances, ie the processing is:

  1. •

    necessary for entering into, or performance of, a contract between the data subject and a data controller

Powered by Lexis+®
Jurisdiction(s):
United Kingdom
Related legal acts:
Key definition:
Data protection definition
What does Data protection mean?

In an employment context, this refers to the obligation on an employer to protect the data of its employees and ensure that it complies with the law on how it uses the employees' data.

Read more readmore

Popular documents

If a multinational company with entities in a number of EU states has registered a data protection

If a multinational company with entities in a number of EU states has registered a data protection officer (DPO) with the Information Commissioner’s Office (ICO), does it need to register a DPO in the other EU states where it has entities or is registration in one country sufficient?Under Article 37

How do I calculate the time limit for responding to a data subject request?

How do I calculate the time limit for responding to a data subject request?The General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) provides for enhanced rights for data subjects, including providing rights of access, rectification, erasure and restriction of processing, data

Refusing a data subject request—what is ‘manifestly unfounded or excessive’?

Refusing a data subject request—what is ‘manifestly unfounded or excessive’?The General Data Protection Regulation (GDPR) provides for enhanced rights for data subjects, including providing rights of access, rectification, erasure and restriction of processing, data portability, a right to object to

Data protection officer—DPO—job description and role profile

Data protection officer—DPO—job description and role profile1DPO detailsName of organisation[Insert name of organisation]Name of DPO[Insert name]Reports to[Insert name and/or position]Full time/part time[Insert]Details of any other roles held within the organisation[Insert details of any other roles