GDPR Article 22 is the EU privacy rule that limits decisions made solely by automated processing when they produce legal or similarly significant effects on a person. In practice, it matters for systems that score, rank, approve, reject, or select people without meaningful human review. It is not a blanket ban on automation, but it does require organizations to be careful about when a machine is allowed to make the final call.
In cyber security and defensive governance, Article 22 shows up as a control requirement: teams need audit logs, version tracking, data provenance, and a real human-oversight step that can override an algorithm. In HR, for example, if software helps decide layoffs or role changes, the company must be able to show that the decision was not purely automatic and that the person affected can challenge it. Weak logging, opaque models, or fake “human review” can turn an ordinary workflow into a compliance and security risk.