GDPR-K Article 22 - Automated individual decision-making, including profiling (where the data subject is a child)
Solely automated decisions with legal or similarly significant effects are prohibited unless an Article 22(2) ground applies; where the ground is contract necessity or explicit consent, the Article 22(3) safeguards must be in place and effective for a child
Where this comes from
Provision: Article 22 - Automated individual decision-making, including profiling (where the data subject is a child)
Instrument: General Data Protection Regulation (EU) 2016/679
Citation: Regulation (EU) 2016/679, OJ L 119, 4.5.2016, Article 22(1)-(4); read with Recital 71; WP251 rev.01 (endorsed by the EDPB 25 May 2018) s V
Text version: Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, as adopted (CELEX 32016R0679), read from the Publications Office Cellar manifestation on 2026-09-21 because EUR-Lex served an empty body to non-browser clients; the 2018 corrigendum (OJ L 127, 23.5.2018) was not retrievable, so any correction it made is unverified.
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
- Service makes solely automated decisions with legal or similarly significant effects
…unless:
- Article 22(1) does not apply where the decision is necessary for entering into, or performance of, a contract between the data subject and a data controller; the Article 22(3) safeguards then apply and must be effective for a child. (Regulation (EU) 2016/679, Article 22(2)(a))
- Article 22(1) does not apply where the decision is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights, freedoms and legitimate interests. (Regulation (EU) 2016/679, Article 22(2)(b))
- Article 22(1) does not apply where the decision is based on the data subject's explicit consent; the Article 22(3) safeguards then apply and, for a child below the Article 8 age, consent is given or authorised by the holder of parental responsibility. (Regulation (EU) 2016/679, Article 22(2)(c))
Scope in the source's own terms
- Service uses automated decision-making or profiling
- Decisions affect child users
- Processing subject to GDPR (EU scope; block moved from UK-GDPR authorship)
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- User model has `profilingEnabled` boolean field (default: false)
- Recommendation engine checks profilingEnabled before processing user
- Behavioral tracking skips users with profilingEnabled=false
- Ad targeting excludes users with profilingEnabled=false
- Admin dashboard shows count of users with profiling disabled
Evidence an auditor expects
- Technical controlTechnical audit
Human review mechanism
Technical implementation allowing human intervention in automated decisions affecting children
- Policy documentDocument review
Automated decision-making policy
Policy documenting automated decision logic, safeguards, and human oversight for decisions affecting children
- User-interface evidenceUser testing
Explanation and contest mechanism
Child-friendly interface explaining automated decisions and allowing them to contest or request human review
- Process recordLog analysis
Human review request log
Records of human review requests and outcomes
Questions people ask
- Does GDPR-K Article 22 - Automated individual decision-making, including profiling… apply to my service?
- It applies when Service is likely to be accessed by children under 18; Service makes solely automated decisions with legal or similarly significant effects. It does not apply where Article 22(1) does not apply where the decision is necessary for entering into, or performance of, a contract between the data subject and a data controller; the Article 22(3) safeguards then apply and must be effective for a child. (Regulation (EU) 2016/679, Article 22(2)(a)).
- From when does this apply?
- GDPR-K Article 22 - Automated individual decision-making, including profiling… applies from 25 May 2018. Its current status is: in force.
- What evidence does an auditor expect?
- Human review mechanism; Automated decision-making policy; Explanation and contest mechanism.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.