# Automated individual decision-making, including profiling — GDPR — context bundle > Focused context for a single provision, curated from overview.legal on 2026-08-22. Canonical page: https://overview.legal/laws/gdpr/art-22 > Every item cites its source. Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it. ## Provision ### Automated individual decision-making, including profiling — Automated individual decision-making, including profiling *GDPR, gdpr-art-22-en — https://overview.legal/laws/gdpr/art-22* 1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. 2. Paragraph 1 shall not apply if the decision: a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or c) is based on the data subject's explicit consent. 3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. 4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. ## Enforcement 20 decision(s) on record cite Article 22, totalling approximately €22,252,983 in fines (median €87,500). Top fines: - **Clearview Al Inc.: Non-compliance with general data processing principles** (UNITED KINGDOM, €9,000,000) — https://overview.legal/posts/47305 - **Foodinho Srl: Non-compliance with general data processing principles** (ITALY, €5,000,000) — https://overview.legal/posts/48646 - **Foodinho s.r.l.: Non-compliance with general data processing principles** (ITALY, €2,600,000) — https://overview.legal/posts/46858 - **Deliveroo Italy s.r.l.: Non-compliance with general data processing principles** (ITALY, €2,500,000) — https://overview.legal/posts/46905 - **Fastweb S.p.A.: Non-compliance with general data processing principles** (ITALY, €1,000,000) — https://overview.legal/posts/48655 ## Guidance ### Guidelines on processing of personal data through blockchain technologies *EDPB — https://overview.legal/posts/125668* Guidelines 02/2025 on processing of personal data through blockchain technologies Version 2.0 Adopted on 07 July 2026 1 | Adopted Version history Version Date Adoption information version 1.1 08 April 2025 adoption of the guidelines before public consultation version 2.0 07 July 2026 adoption of the guidelines after public consultation 3 | Adopted 4 | Adopted The European Data Protection Board Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of the… ### Opinion 14/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR *EDPB — https://overview.legal/posts/125682* Opinion 14 / 2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal pursuant to Article 42.5 GDPR Adopted on 15 April 2026 1 | Adopted 2 | Adopted The European Data Protection Board Having regard to Article 63, Article 64 (2) and Article 42 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free… ### EDPB Annual Report 2025 *EDPB — https://overview.legal/posts/125683* Clarity in action: Supporting stakeholders through guidance and dialogue Annual Report 2025 Foreword 3 Highlights 4 1. The EDPB Secretariat 6 1.1 Mission And Activities 8 2. European Data Protection Board – Activities in 2025 12 2.1 Bridging Fundamental Rights and Digital Innovation Through GDPR Compliance 12 2.1.1 Helsinki high-level meeting: enhanced clarity, support and engagement 12 2.1.2 Regulation on procedural rules and Omnibus regulation on the record of processing 14 2.1.3 Cross… ### Report on stakeholder event on processing of personal data to target or deliver political advertisements *EDPB — https://overview.legal/posts/125684* Report on stakeholder event on processing of personal data to target or deliver political advertisements 27 March 2026 1. Background The EDPB organised an online stakeholder event on 27 March 2026 to collect stakeholders’ input on processing of personal data to target or deliver political advertisements. The objective was to engage with stakeholders at an early stage of drafting the EDPB Guidelines on the processing of personal data to target or deliver political advertisements (Chapter III of… ### EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( *EDPB — https://overview.legal/posts/53739* EDPB, EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus) ## Related topics - **Marketing** — https://overview.legal/topics/marketing ## Legal Framework - **Profiling** — https://overview.legal/topics/profiling ## Legal Framework - **Automated Decision-Making** — https://overview.legal/topics/geautomatiseerde-besluitvorming ## Legal Framework --- Generated by overview.legal · https://overview.legal/laws/gdpr/art-22 · 2026-08-22