Automated Processing

Automated processing covers any operation on personal data performed by machines without a human in the loop. GDPR Article 22 gives data subjects a right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for a contract, authorised by law, or based on explicit consent. Where it is permitted, meaningful information about the logic involved, the significance and the envisaged consequences must be provided to the subject.

The DPDP Act does not create an Article 22-equivalent standalone right, but Significant Data Fiduciaries must conduct algorithmic risk assessments under section 10 and Rule 13 for processing that uses automated decision-making. Rule 10 also prohibits behavioural tracking and targeted advertising for children. The EU AI Act adds a parallel layer: a 'high-risk AI system' used for consequential decisions (employment, credit, insurance, education, essential services) must satisfy additional transparency, data-governance, human-oversight and record-keeping duties.