What evidence do auditors commonly ask for on Art.22 Automated individual decision-making, including profiling?

An inventory of automated decisions with the assessment of whether each produces legal or similarly significant effects; The exception relied on for each in scope decision, and for contract based ones the necessity reasoning rather than a convenience argument; The human intervention process, showing the reviewer has the authority and the information to change the outcome; Records of contested decisions and the outcome of each review; Confirmation of whether special category data, including proxies for it, enters the model, and the safeguards applied where it does.

What is the most common gap auditors find on Art.22?

A rubber stamp reviewer treated as human involvement, which leaves the decision solely automated in substance

GDPR · Chapter III - Rights of the Data Subject

`Art.22` Automated individual decision-making, including profiling

Do not subject a data subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract between the data subject and the controller, is authorised by Union or Member State law that lays down suitable safeguards, or is based on the data subject's explicit consent. Where the contract or explicit consent route is used, implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express a point of view and to contest the decision. Such decisions must not be based on special categories of personal data unless explicit consent or substantial public interest applies and suitable safeguards are in place.

Source: GDPR, Art.22. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open GDPR in the compliance library.

Many articles apply only where their condition is met (a data protection officer under Article 37, an impact assessment under Article 35, a representative under Article 27); the condition is in each statement.

artefacts

held by a system

at each review

hard

to go live

Document repository

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

Records of contested decisions and the outcome of each review · Document repository
Confirmation of whether special category data, including proxies for it, enters the model, and the safeguards applied where it does · Document repository

governing documentDocuments that govern the control

An inventory of automated decisions with the assessment of whether each produces legal or similarly significant effects · Policy repository / GRC workspace
The exception relied on for each in scope decision, and for contract based ones the necessity reasoning rather than a convenience argument · Vendor register / contract repository
The human intervention process, showing the reviewer has the authority and the information to change the outcome · Document repository

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

A rubber stamp reviewer treated as human involvement, which leaves the decision solely automated in substance
Necessity for a contract asserted where a manual or hybrid process would work and is merely more expensive
Special category data entering the model through proxies such as postcode, name or purchase history with no assessment
No route for the data subject to contest the decision, only a route to complain about service

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

Art.21 Right to object · Art.24 Responsibility of the controller