[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F22":3},{"item":4,"lessons":16,"controls":66,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","22","Article 22","Automated individual decision-making, including profiling",63,"General Data Protection Regulation","**What it asks for.** Individuals have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Exceptions exist where the decision is necessary for a contract, authorised by law or based on explicit consent, but in the contract and consent cases the controller must provide safeguards, including at least the right to obtain human intervention, express a view and contest the decision.\n\n**In practice.** Organisations identify automated decisions in their processing, assess whether they fall within the article and, where they do, provide meaningful human review and a way to challenge outcomes. Transparency obligations require meaningful information about the logic involved. Evidence includes an inventory of automated decisions, DPIAs and records of human reviews.\n\n**Common gaps.** Human involvement is sometimes nominal, with reviewers who approve outputs without real authority. The use of AI models in hiring, credit or fraud decisions is often not assessed against this article.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_22","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"ai-chatbots-targeted-by-covert-political-influence-networks","AI Chatbots Targeted by Covert Political Influence Networks","2026-10-15T20:20:35.974+00:00",{"slug":23,"title":24,"published_at":25},"ai-confidence-accuracy-human-oversight-is-non-negotiable-in-forensics","AI Confidence ≠ Accuracy: Human Oversight Is Non-Negotiable in Forensics","2026-10-15T14:21:23.922+00:00",{"slug":27,"title":28,"published_at":29},"unauthorised-ai-agent-actions-expose-gaps-in-governance-and-oversight","Unauthorised AI Agent Actions Expose Gaps in Governance and Oversight","2026-10-14T18:22:00.668+00:00",{"slug":31,"title":32,"published_at":33},"ai-hiring-tools-trigger-gdpr-scrutiny-over-missing-risk-assessments","AI Hiring Tools Trigger GDPR Scrutiny Over Missing Risk Assessments","2026-10-14T10:20:18.748+00:00",{"slug":35,"title":36,"published_at":37},"ai-agents-are-the-new-bec-target-social-engineering-evolves","AI Agents Are the New BEC Target: Social Engineering Evolves","2026-10-09T14:20:26.055+00:00",{"slug":39,"title":40,"published_at":41},"mathematical-formula-reveals-ai-chatbot-rogue-output-tipping-points","Mathematical Formula Reveals AI Chatbot 'Rogue Output' Tipping Points","2026-10-09T06:20:39.603+00:00",{"slug":43,"title":44,"published_at":45},"ai-hiring-tool-triggers-gdpr-warning-over-lack-of-dpias-and-transparency","AI Hiring Tool Triggers GDPR Warning Over Lack of DPIAs and Transparency","2026-10-08T16:21:43.317+00:00",{"slug":47,"title":48,"published_at":49},"uber-fined-825m-for-opaque-automated-driver-deactivations","Uber Fined €825M for Opaque Automated Driver Deactivations","2026-10-08T14:20:56.047+00:00",{"slug":51,"title":52,"published_at":53},"agentic-ai-escapes-guardrails-exposing-legal-blind-spots","Agentic AI Escapes Guardrails, Exposing Legal Blind Spots","2026-10-02T18:20:24.469+00:00",{"slug":55,"title":56,"published_at":57},"ftc-probes-openai-anthropic-over-ai-agent-safety-and-consumer-risks","FTC Probes OpenAI & Anthropic Over AI Agent Safety and Consumer Risks","2026-10-01T00:20:23.357+00:00",{"slug":59,"title":60,"published_at":61},"ai-agents-acting-autonomously-can-create-legal-liability-for-organizations","AI Agents Acting Autonomously Can Create Legal Liability for Organizations","2026-09-29T20:20:40.968+00:00",{"slug":63,"title":64,"published_at":65},"openai-halts-gpt-61-astra-release-after-safety-audits-reveal-deception-and-unauthorized-actions","OpenAI Halts GPT-6.1 Astra Release After Safety Audits Reveal Deception and Unauthorized Actions","2026-09-29T08:21:23.381+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",24,{"slug":73,"name":74,"problem":75,"stories":76},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",12,{"slug":78,"name":79,"problem":80,"stories":81},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",11,{"slug":83,"name":84,"problem":85,"stories":86},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",6,{"slug":88,"name":89,"problem":90,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":92,"name":93,"problem":94,"stories":95},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",3,[97,102,107,113,118,122,127,131],{"family":98,"item":99,"code":100,"title":100,"together":101},"itil","overview","ITIL",41,{"family":103,"item":99,"code":104,"title":105,"together":106},"nist-ai-rmf","AI RMF 1.0","AI Risk Management Framework (AI RMF 1.0)",38,{"family":108,"item":109,"code":110,"title":111,"together":112},"cis","3","Control 3","Data Protection",35,{"family":114,"item":99,"code":115,"title":116,"together":117},"nist-privacy","Privacy Framework","NIST Privacy Framework",26,{"family":5,"item":119,"code":120,"title":121,"together":71},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":108,"item":123,"code":124,"title":125,"together":126},"8","Control 8","Audit Log Management",20,{"family":5,"item":128,"code":129,"title":130,"together":126},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":132,"item":133,"code":134,"title":135,"together":136},"iso","42001","ISO\u002FIEC 42001","ISO\u002FIEC 42001: Artificial intelligence management system",19]