Automated Decision-Making

Intent

A person cannot challenge an automated decision they do not know was made. Saying whether any were made is the first step, and it is a yes-or-no answer.

How to test it

An assessor scores the criterion against a single response:

Score 2

The response answers yes or no to whether the organisation makes solely automated decisions about the person, profiling included.

Score 1

The response mentions automated tools without saying whether any decision was made by them alone.

Score 0

The response says nothing about automated decision-making.

The law it reflects

This criterion reflects Article 15(1)(h) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See E8 in context in the full standard.