How do I keep an automated decision GDPR-compliant?
If a decision about a person is made solely by an algorithm and it has a legal or similarly significant effect on them (denying a refund, a loan, an account), GDPR Art. 22 restricts it: as a rule the person has the right not to be subject to a solely automated decision of that kind. Where such a decision is permitted anyway (for example because it is necessary for a contract or based on the person's explicit consent), Art. 22(3) requires safeguards, including a way to obtain human intervention, express a view, and contest the outcome. Either way, do not let the automated branch be the final word: route these decisions to a path where a person can review.
Work out whether Art. 22 is in play
Two things have to be true for the rule to bite: the decision is solely automated (no meaningful human involvement) and it produces a legal or similarly significant effect on the person. A pricing hint is not that; auto-denying someone's refund, loan, or account can be, depending on how material the effect is. When both are true, a purely automated final decision is what Art. 22 restricts.
Give the significant path a human review
For the decisions that qualify, the automated step should hand off rather than finalise. Send the case to a queue a person can act on, and make the human review a real step, not a rubber stamp. Where the decision runs under one of Art. 22's permitted bases, the person can also express their view and contest the outcome, and expects meaningful information about how the decision was reached, so the path has to be able to surface why.
export async function decideRefund(req: RefundRequest) { const score = await risk.score(req)- if (score < 0.2) return { status: "rejected", reason: "auto" }+ if (score < 0.2) return queueForReview(req, "low-score") return queueForReview(req)}The low-score case now goes to human review instead of a final automated rejection, which is what a significant decision needs under Art. 22.