GDPR and AI: Article 22 automated decision-making, DPIAs, and the controller's ten obligations
The GDPR applied to AI before any AI law existed, and it still does: whenever an AI system processes personal data, the full regulation follows. For the AIGP exam it is the most important non-AI law there is.
Why this matters for the AIGP exam
Article 22 on automated decision-making is one of the most heavily tested single provisions in the whole Body of Knowledge, and GDPR-principle questions recur across all four domains.
The essentials
- The principles bind AI pipelines. Lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. The pair the exam most likes to separate: purpose limitation (use data only for the purpose collected) versus data minimisation (collect no more than needed).
- Article 22 is a conditional right, not a ban. It applies when a decision is based solely on automated processing and has legal or similarly significant effects — credit refusals, e-recruiting rejections. Both conditions must hold; meaningful human involvement takes a decision outside it.
- Three exceptions allow solely automated decisions: necessity for a contract, authorisation by EU or member-state law, or explicit consent — and each still requires safeguards, including the right to human intervention and to contest the decision.
- DPIAs. A data protection impact assessment is mandatory where processing is likely to produce high risk — systematic and extensive automated evaluation, large-scale processing of sensitive data, or systematic public monitoring. Most AI systems making decisions about people qualify.
What the exam asks
Whether Article 22 applies to a described decision, which exception a company is relying on, which principle a data practice violates, and when a DPIA should have been run.
Going deeper
This page is the condensed version. The full topic — with the detail above expanded and practice questions attached — is in the app, inside Domain II. Domain I, a quarter of the course, is free to try first.
Back to the AIGP study guide.
AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.