A significant decision (one with a legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement (Article 22A, which requires the extent of profiling to be considered), may not rest wholly or partly on special category data unless it is based entirely on data the data subject explicitly consented to, or it is necessary for a contract with the data subject or required or authorised by law and the substantial public interest condition in Article 9(2)(g) applies. No such decision may be taken where the processing for it relies wholly or partly on a recognised legitimate interest. Outside these restrictions, solely automated significant decisions are permitted if Article 22C safeguards are in place; this replaces the former Article 22 prohibition for decisions taken from 5 February 2026.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.