7.3.10 Automated decision making
The organization must identify and address the obligations, including legal obligations, that it owes to individuals arising from decisions it makes about them based solely on automated processing of their personal data,
5
artefacts
3
held by a system
1
at each review
easy
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Inventory of decisions made solely by automated processing, with their effect on individuals assessed · Policy repository / GRC workspace
- Notification content disclosing the existence and logic of automated decision making · Document repository
- Objection route specific to automated decisions · Document repository
periodic reviewEvidence produced at each review
- Documented human intervention route with evidence it is genuine and available · Document repository
governing documentDocuments that govern the control
- Obligations register per jurisdiction for those decisions · Policy repository / GRC workspace
First move
Automate the pull from your Document repository. Version-controlled document with owner, approval and review date as metadata.
Common gaps auditors find
- Automated decisions unrecognised as such because a person nominally approves an output they never question, which is not meaningful human involvement
- Inventory covering the obvious scoring engine while automated rules embedded in workflow tools go unlisted
- Human intervention offered on a channel that has no authority to overturn the decision
- Jurisdictions that prohibit fully automated decisions in the relevant context not identified
- Notification stating that automation is used without conveying the significance to the individual
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet