Automated Decision-Making

Automated decision-making (ADM) is specifically regulated where it produces legal effects or similarly significantly affects the individual. GDPR Article 22 gives data subjects a right not to be subject to such decisions unless the processing is necessary for a contract, authorised by law, or based on explicit consent — and even then, meaningful information about the logic involved, the significance and the envisaged consequences must be provided, and human-intervention rights preserved. The EU AI Act adds parallel duties where the ADM system is a 'high-risk AI system' under Annex III (employment, credit, insurance, essential public services).

Under the DPDP Act, ADM is not a standalone right-regulated topic, but Significant Data Fiduciaries must conduct algorithmic risk assessments under Section 10 and Rule 13 before deploying automated decision-making. The Colorado AI Act and emerging US state AI laws impose similar impact-assessment and consumer-notice duties for 'consequential decisions'. For a global programme, maintaining a single ADM inventory with per-system notes on applicable law, lawful basis, human-oversight design and the specific transparency wording in notices is the pragmatic baseline.