ARCHETYPAL
CGRCC / requirement

Article 22(1)

REQ-b355790e12f878de5bf3 · LEGACY_INTERPRETATION · source version 7c0d10cd9a0cd672

Data controllers must protect against solely automated significant decisions

Meaning & implementation context

Catalog material requires organizational applicability review. Reported support, approval and maturity are statements from the source, not current enforcement verification.

Source Id
eu-gdpr
Control
Article 22(1)
Source Version
Regulation 2016/679
Url
https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
Actor
Data controllers
Modality
must
Action
protect
Object
against solely automated significant decisions
Condition
Subject to Article 22 exceptions and safeguards
Exception
See article-specific exceptions and safeguards
Timing
Not recorded
Authority
binding-within-scope
Jurisdiction
European Union
Checked At
2026-10-03
Status
interpretation-needs-review
Examples
{ "meetsRule": "Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.", "doesNotMeetRule": "Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.", "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match." }

Source-reported relationships

1 associations retained with their original context.

SUPPORTED BY SOURCE REQUIREMENT · AIR-0156EA65AB@302d0c170dbf354c

SOURCE_REPORTED_REVIEW_REQUIRED

{
  "sourceKey": "eu-gdpr@86540090d955",
  "locator": "Article 22(1)"
}
Inspect target record ↗

Owner interpretation review

Append a catalog review decision. The source record remains immutable.

Owner sign-in

Versioned CGRCC JSON
{
  "key": "REQ-b355790e12f878de5bf3@7c0d10cd9a0cd672",
  "id": "REQ-b355790e12f878de5bf3",
  "version": "7c0d10cd9a0cd672",
  "kind": "requirement",
  "lifecycle": "LEGACY_INTERPRETATION",
  "title": "Article 22(1)",
  "statement": "Data controllers must protect against solely automated significant decisions",
  "family": "Governance",
  "body": {
    "sourceId": "eu-gdpr",
    "control": "Article 22(1)",
    "sourceVersion": "Regulation 2016/679",
    "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng",
    "actor": "Data controllers",
    "modality": "must",
    "action": "protect",
    "object": "against solely automated significant decisions",
    "condition": "Subject to Article 22 exceptions and safeguards",
    "exception": "See article-specific exceptions and safeguards",
    "timing": null,
    "authority": "binding-within-scope",
    "jurisdiction": "European Union",
    "checkedAt": "2026-10-03",
    "status": "interpretation-needs-review",
    "examples": {
      "meetsRule": "Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.",
      "doesNotMeetRule": "Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.",
      "outOfScope": "The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."
    }
  },
  "versions": [
    {
      "version": "7c0d10cd9a0cd672",
      "key": "REQ-b355790e12f878de5bf3@7c0d10cd9a0cd672"
    }
  ],
  "provenance": [],
  "relationships": [
    {
      "id": "MAP-e57663b13517dc71b3b0d1c9",
      "from": "AIR-0156EA65AB@302d0c170dbf354c",
      "to": "REQ-b355790e12f878de5bf3@7c0d10cd9a0cd672",
      "kind": "SUPPORTED_BY_SOURCE_REQUIREMENT",
      "status": "SOURCE_REPORTED_REVIEW_REQUIRED",
      "body": {
        "sourceKey": "eu-gdpr@86540090d955",
        "locator": "Article 22(1)"
      },
      "fromKeys": [
        "AIR-0156EA65AB@302d0c170dbf354c"
      ],
      "toKeys": [
        "REQ-b355790e12f878de5bf3@7c0d10cd9a0cd672"
      ],
      "resolution": "RESOLVED_REFERENCE_REVIEW_REQUIRED"
    }
  ]
}
Back to CGRCC Registry