Laws · GDPR ·art-22-par-3 EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
Full text
In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
How it connects
Cited by
- Guidelines 03/2021 on the application of Article 65(1)(a) GDPR
- Foodinho s.r.l.: Non-compliance with general data processing principles
- Deliveroo Italy s.r.l.: Non-compliance with general data processing principles
- Deutsche Kreditbank: Insufficient fulfilment of data subjects rights
- Foodinho Srl: Non-compliance with general data processing principles
All 22
- Guidelines 3/2025 on the interplay between the DSA and the GDPR
- Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision
- GDPR complaint: Airbnb hosts at the mercy of algorithms
- EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (
- If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
- EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro
- EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
- EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act)
- CK v Magistrat der Stadt Wien
- OQ v Land Hessen
- General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
- HOW GDPR TREATS AUTOMATED DECISION-MAKING
- BVwG - W254 2253353-1
- HDPA (Greece) - 12/2026
- Garante per la protezione dei dati personali (Italy) - 483/2026
- Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on
- Italian DPA finds Cerved Group failed to disclose creditworthiness scores in Art. 15
Related across sources
CJEU Google Spain: data subject may require search engine to remove links to outdated Legitimate interest balancing test: Legitimate interest requires balancing of the interest of the controller and third party with the interest of the data subject. In this… May 13, 2014 Personal Data Legitimate Interest Right to Rectification
CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is Processing: Communication of personal data in response to a request for access to documents constitutes processing. (¶69) Jun 29, 2010 Personal Data Legitimate Interest Right to Restriction
W137 2333649-1 Federal Administrative Court: retention of job applicant data for potential legal claims The data subject applied for a job with the association and provided additional documents, regarding the use of their personal data. Among other things, it was stated that the… Jul 8, 2026 Storage Limitation Retention Period Right to be Forgotten
Guidelines 2/2018 derogations of Article 49 under Regulation 2016/679 Guidelines on derogations of Article 49 Guidelines ·EDPB May 25, 2018 Privacy Shield Lawful Basis Legitimate Interest
Guidelines 3/2019 processing of personal data through video devices Guidelines ·EDPB Jan 30, 2020 Personal Data Processing Material scope (GDPR)
Guidelines 02/2024 Article 48 GDPR Article 48 GDPR provides that: ' Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to… Guidelines ·EDPB Jun 5, 2025 Controllers Privacy Shield International Transfer