Data Protection

GDPR Automated Decisions: Explanation and Evidence

An automated decision review needs two things: an explanation a person can understand and records that support that explanation. A technical ledger alone does not establish that a decision was lawful.

Separate safeguards from access rights

Article 22 addresses decisions based solely on automated processing that produce legal or similarly significant effects, with exceptions and safeguards. Meaningful information about the logic involved, significance and envisaged consequences appears in the GDPR's transparency and access provisions, including Article 15(1)(h). The EDPB's endorsed automated-decision guidelines explain the relationship. Assess the actual workflow, effect and human involvement rather than assuming every AI recommendation falls within Article 22.

What an explanation must achieve

In C-203/22, Dun & Bradstreet Austria, the Court considered access to meaningful information about automated credit assessment. Its 27 February 2025 court summary explains that the procedure and principles actually used should be described so the person can understand which personal data were used and how. Merely providing an algorithm is insufficient. The summary does not prescribe RFC 3161 timestamps or hash chains.

Build a reviewable decision record

The following is a practical review checklist, not a statutory technical specification or a guarantee of acceptance:

• Identify the selected decision and the records that connect to it.
• Preserve the relevant data, model/configuration references and policy context you are authorised to retain.
• Distinguish the recommendation from the decision and resulting action.
• Record meaningful human review, approval or override where relevant.
• Retain the explanation provided and the handling of any challenge or correction.

A later model re-run may differ from the original decision. Label reconstructed material with its sources, creation date and uncertainty. Do not present it as a contemporaneous record or assume all later reconstruction is legally invalid.

Integrity does not establish truth

Integrity checks can help compare an export with a retained reference. They do not establish that source data were accurate, an approval was legitimate or the decision was lawful. Hash chains and third-party timestamps are technical choices, not a universal court-acceptance guarantee. A timestamp on a bundle does not establish the exact time of every event described inside it.

Set retention for the actual purpose

Do not adopt a blanket five-to-seven-year period from this article. Determine and document the applicable purpose, legal obligations, jurisdiction, access restrictions and deletion schedule. Retaining more personal data indefinitely is not a substitute for a justified policy.

Keep the AI Act assessment separate

The Commission's current timeline reports Annex III high-risk rules applying from 2 December 2027 and regulated-product high-risk rules from 2 August 2028. Classification and transitional rules must be assessed for the particular system. GDPR and AI Act obligations are distinct; one is not a technical superset of the other.