Article 22 of the GDPR limits decisions that are based solely on automated processing and that produce legal or similarly significant effects on a person. In practice, it is the rule that asks whether a machine, without meaningful human involvement, is making an important decision about access, money, identity, or services. The law does not ban automation, but it does require safeguards in many cases, such as human review, the chance to contest the decision, and clear information about how the system works.
In cyber security, Article 22 matters because many defenses rely on automated scoring and blocking: fraud filters, account-risk engines, identity checks, and abuse detection can all affect real users. If these systems make final decisions on their own, they may trigger GDPR obligations. Attackers may also try to exploit such systems by causing false positives, poisoning models, or manipulating identity signals so that automated controls misclassify a target. For defenders, the key lesson is to combine automation with oversight, logging, and appeal paths so security actions remain both effective and legally defensible.