Did You Know GDPR Can Restrict Fully Automated Decision Flows That Affect Individuals?

Introduction

Why Process Orchestration Matters More in the Age of Agentic AI is a series in which we ask one question: holistically, what does good look like?

Like most automation architects, I love straight-through processing. But did you know the GDPR can prevent certain decision flows from being fully automated?

Article 22 gives individuals the right not to be subject to a decision based solely on automated processing when it produces legal effects or similarly significantly affects them.

Two points for process architects

1. It applies to individuals, not just existing customers. A potential customer is still a data subject if an organisation processes their personal data. Customer onboarding and loan applications can therefore fall within scope when a solely automated decision has legal or similarly significant effects.

2. It applies to the decision-making itself. The key question is whether the significant decision is based solely on automated processing, not whether the wider process contains a human task somewhere. A person added later to communicate, audit or review the result is not part of the original decision-making. Meaningful human involvement must sit within the core decision activity, not be bolted on after the outcome has been decided.

That does not make every automated decision unlawful. Article 22 has a specific scope and contains exceptions. These include decisions authorised by law, contracts that meet the narrow 'necessity test' and decisions based on explicit, informed opt-in consent. Depending on the exception, safeguards can include the right to obtain human intervention, express a point of view and contest the decision.

An illustration of why this protection exists

Imagine a couple walking into a bank to apply for a mortgage on their first home. Their paperwork is ready and they have saved the deposit.

The bank scans their documents and asks an AI model to assess the application. The model declines it. A member of staff communicates the result but cannot explain how it was reached, justify the outcome or, most importantly, offer a practical plan for addressing any gaps. To make matters worse, imagine that the decline is automatically added to their credit history, potentially affecting future credit applications.

The bank has used a sophisticated neural network model that is effectively a black box to the people running the process. In doing so, it has outsourced both the decision and responsibility for it to the AI.

For the couple, there is no transparency, no explanation and no practical route forward. Within the bank, there is no clear human ownership or accountability.

Everyone leaves frustrated. AI has created another barrier to accessing the service instead of becoming the holy grail of automation-led customer excellence.

Three process patterns to watch out for

1. The decision and consequence happen in one step

The AI outcome immediately updates the case or triggers a consequence before a person can take part in the core decision.

2. Human review is only a rubber stamp

Having a 'human in the loop' is not enough if their only role is to communicate a decision that has already been made. They need to take part in the core decision-making, with the context, time and authority to reach an independent outcome.

3. The outcome is a dead end, often followed by a meaningless post-mortem

Some organisations review these interactions afterwards, asking a team or a second AI agent to assess what happened and add 'lessons learnt' to a RAG knowledge base. That may improve future cases, but it does nothing for the person already affected. It provides neither meaningful human intervention in the original decision nor a route to express their view and contest the outcome. A retrospective review is not a substitute for safeguards when the decision is made.

What could good look like?

This is not solved simply by placing an 'Approve' button at the end of an otherwise automated flow.

A better pattern separates the preparation of evidence, the human decision and the communication of the outcome. AI can gather data, prepare the application, summarise its findings and flag potential issues, but a trained person makes an independent decision before the outcome takes effect. If the application is declined, the applicant receives a clear explanation, practical next steps and a route to challenge the decision if appropriate.

Good orchestration can also run complementary technologies in parallel. For example, an AI model can summarise complex evidence while deterministic business rules check clear eligibility criteria and mandatory controls. Bringing those outputs together can expose conflicts instead of allowing one model to become the sole source of truth.

The model and its findings should also be explainable enough to examine and challenge. The reviewer needs to understand the important factors behind the findings, while the individual needs a clear account of the eventual decision and a meaningful opportunity to contest it.

The important design choices are to:

• Detect when a decision may fall within Article 22
• Use complementary technologies to test the evidence from different angles
• Prefer models and findings that can be explained, examined and challenged
• Pause the automated flow before the outcome takes effect
• Give a trained reviewer the context, evidence and authority to reach an independent decision
• Record the automated findings and the human decision separately
• Explain the outcome, provide a clear reason for the conclusion and give the person a route to query it

Conclusion

The lesson for Agentic AI is simple: better decision-making does not remove the need for process. The more consequential the decision, the more important it becomes to orchestrate accountability around it.

For further interpretation, see the European Data Protection Board’s guidance on automated decision-making and profiling.

This is a process-design observation, not legal advice.