Under the GDPR, processing by automated means is much broader than making a decision with artificial intelligence. Storing a customer’s details in a computer system or searching an electronic personnel file can fall within the concept even when a person entered every item manually. Article 2 also covers certain non-automated processing: personal data forming part of a filing system, or intended to become part of one.
These are rules about the GDPR’s material scope. They must be read alongside the meaning of personal data, the exclusions in Article 2 and the territorial rules in Article 3. They are separate from Article 22, which concerns decisions based solely on automated processing with legal or similarly significant effects. This distinction prevents both underestimating ordinary data processing and treating every spreadsheet as a prohibited automated decision.
Read Article 2 as two alternative routes into scope
Article 2(1) of the GDPR covers personal-data processing carried out wholly or partly by automated means. It also covers processing by other means where the personal data form part of, or are intended to form part of, a filing system. An organisation should assess both routes before concluding that an activity falls outside the Regulation.
The GDPR does not supply a separate, exhaustive Article 4 definition of the phrase “automated means”. It should therefore not be presented as a statutory quotation invented from a technical description. In ordinary business practice, electronic storage, retrieval, calculation and transmission provide clear examples of automated operations. The legal assessment concerns what happens to personal data, rather than whether the organisation markets its system as automated.
The word “partly” matters. A person may collect information during an interview, type it into software and then review a report personally. Human involvement in that sequence does not remove the electronic operations from Article 2. Conversely, a purely non-personal dataset does not become personal data merely because sophisticated software processes it.
A useful first description records the information, the people it relates to and the operations performed. The Article 4 definitions provide the framework: collection, storage, consultation, disclosure and deletion can all be processing. The analysis is wider than identifying a calculation or an algorithm.
Establish whether the information is personal data
Personal data relate to an identified or identifiable natural person. A name is an obvious example, but an account identifier, device identifier or combination of attributes may also make someone identifiable in the relevant circumstances. The guide to personal data explains why the surrounding means of identification matter.
For example, a supplier may receive a customer reference rather than a customer’s name. If the reference still allows the person to be identified in the circumstances, describing it as a code does not settle the question. Pseudonymisation can reduce risk while leaving the information subject to the GDPR. Anonymous information requires a different assessment and cannot be inferred merely from removing direct names.
An IP address likewise requires attention to context and identifiability. A server log can be personal-data processing without recording a visitor’s civil identity in the same file. The organisation should understand the data it holds and the relevant ability to connect it to a person.
This step avoids an unhelpful shortcut: “any digital tool means the whole GDPR applies”. The tool may process no personal data, or the activity may fall within a relevant exclusion. A properly documented scope assessment identifies the actual processing rather than attaching one answer to every use of the software.
Ordinary electronic operations do not require advanced automation
A payroll spreadsheet stores and calculates information about employees. A customer relationship system retrieves contact histories. An email service stores and transmits correspondence containing personal information. None needs a predictive model to satisfy the automated-processing limb of Article 2 where the other scope conditions are met.
The same reasoning applies to digital CCTV recordings, electronic access logs and connected devices when they process identifiable people’s information. A system that merely records or transmits data can be relevant even if no decision follows. The sophistication of the technology does not determine whether security, transparency or retention obligations matter.
Manual entry also does not make an electronic process wholly manual. A receptionist typing a visitor’s name into a database creates an electronic record; an employee reading that record later consults personal data. The organisation cannot exclude the record simply because the original collection involved a conversation and a keyboard.
Assess separate purposes where necessary. A scheduling application may use employee details to organise shifts and also produce performance scores. Both uses can involve automated processing, but they raise different necessity, transparency and decision-making questions. Treating them as one undifferentiated “HR tool” can hide the more consequential operation.
Paper records can be within the GDPR
Article 4(6) describes a filing system as a structured set of personal data accessible according to specific criteria. It can be centralised, decentralised or distributed on a functional or geographical basis. A set of paper personnel files arranged so that information about an employee can be retrieved is therefore not outside the GDPR merely because it is kept in a cabinet.
The intended destination of information also matters. Forms collected for later inclusion in a structured record cannot necessarily be excluded during the interval before filing. An organisation should examine the purpose and organisation of the collection, rather than assuming that a temporary pile of paper is a legal gap.
In C-25/17, Jehovan todistajat, decided on 10 July 2018, the Court interpreted the predecessor Directive’s filing-system concept. Notes collected during door-to-door preaching could qualify where specific criteria allowed the information to be retrieved for subsequent use. Particular data sheets or formal lists were not required. The case concerns the former Directive, while its reasoning on the comparable concept remains useful when reading the GDPR and later case law.
A genuinely unstructured manual activity may fall outside Article 2(1), but that conclusion requires facts about the records and their intended use. It also does not remove obligations under confidentiality, employment or other applicable law. A scope decision should state its boundaries so that later filing or digitisation triggers reassessment.
Speaking information aloud can still be processing
There is no general rule that an unrecorded conversation is outside the GDPR. Oral disclosure can be an operation performed on personal data, and the relationship to a filing system may bring the activity within Article 2. The communication medium alone does not decide the result.
The Court addressed this in C-740/22, Endemol Shine Finland, on 7 March 2024. The case concerned a request for oral information about criminal proceedings from a court’s records. The Court held that oral disclosure constitutes processing and falls within the GDPR’s material scope where the information forms part of a filing system or is intended to do so. The national court had to verify the relevant facts.
For a practical example, an employee who reads a customer record and gives its contents to someone over the telephone does not avoid data protection duties because no new recording is made. The organisation still needs an appropriate basis and safeguards for that disclosure. The same point supports identity and authority checks before staff discuss sensitive account information.
This is different from saying that every spontaneous remark or observation is always regulated by the GDPR. The analysis still requires personal data, a relevant processing operation and the applicable scope conditions. The lesson is to assess the source, structure and use of the information rather than applying a blanket oral-conversation exemption.
Check exclusions and territorial scope separately
Article 2 excludes processing by a natural person in the course of a purely personal or household activity. That exception is tied to the activity and its context, not to a particular device. A personal address book and an organisation’s client database do not acquire the same legal status because both use a phone application.
Other exclusions concern activities outside the scope of Union law, specified Member State activities under the EU treaty framework and processing by competent authorities for the criminal-law purposes listed in Article 2(2)(d). Those situations may be governed by other legal regimes. The fact that a business processes information connected with crime does not itself make it a competent law-enforcement authority.
Territorial scope is another distinct inquiry. Article 3 covers, among other situations, processing in the context of an EU establishment’s activities, even where the processing occurs elsewhere. It also addresses certain processing by organisations outside the EU relating to offering goods or services to people in the Union or monitoring their behaviour there.
Consequently, server location alone does not decide GDPR applicability. A scope record should identify the relevant establishment or targeting circumstances as well as the technology. A conclusion about automated means answers only part of the overall question.
Article 22 asks a narrower decision-making question
Article 22 concerns a decision based solely on automated processing, including profiling, which produces legal effects concerning a person or similarly significantly affects them. Ordinary electronic processing is not enough. There must be a relevant decision, the required degree of automation and the specified seriousness of its effects.
A system that stores an application for a human assessor is different from one that automatically refuses it. However, the process must be examined in practice. A formally human decision may still depend so strongly on an automated output that describing the system as “decision support” fails to capture its real role.
In C-634/21, SCHUFA, decided on 7 December 2023, the Court held that credit scoring can constitute an automated individual decision where the recipient attributes a determining role to the score in granting credit. It left the relevant national-law exception and remaining conditions to be assessed in the national proceedings. The case does not make every score or recommendation automatically subject to Article 22.
Profiling is related but distinct. It involves automated processing used to evaluate personal aspects. A process can involve profiling without producing an Article 22 decision, and an automated decision can occur without the broader predictive analysis people commonly associate with profiling. The consequences and actual workflow determine the assessment.
Human review must have substance
The WP29 guidelines on automated decision-making, endorsed by the EDPB, explain that human involvement must be meaningful. Someone who merely applies an automatically generated result without real influence does not provide an effective human decision stage. The reviewer needs authority and competence to change the outcome and must consider the relevant information.
For example, a manager given a few seconds to approve a score, without access to supporting information or permission to depart from it, may not supply the review the process description promises. By contrast, a reviewer who examines the individual circumstances and can make a different decision has a materially different role. These are factual examples, not automatic legal safe harbours.
The organisation should record when review occurs and what the reviewer can do. Review before a decision is applied is different from a later appeal against an already automated decision. A later opportunity to complain does not retroactively make the original decision non-automated.
Evidence can include instructions, available information, decision records and escalation arrangements. Monitoring should check whether staff exercise their role in practice. A policy statement about human oversight is insufficient if the system design makes departure from the automated result impossible.
Exceptions and explanations require their own analysis
Where Article 22 applies, its exceptions must be assessed separately. They concern necessity for entering into or performing a contract between the person and controller, authorisation by applicable Union or Member State law with suitable safeguards, or the person’s explicit consent. Administrative convenience does not establish contractual necessity, and a general legitimate interest is not an additional Article 22 exception.
For the contract and explicit-consent exceptions, Article 22(3) requires suitable safeguards including the right to human intervention, to express a view and to contest the decision. Decisions based on special-category data face the additional conditions in Article 22(4). The statutory-authorisation route also requires the safeguards specified by that provision and the relevant law.
The information duties in Articles 13, 14 and 15 include specific provisions concerning Article 22 decision-making, including meaningful information about the logic involved and the significance and envisaged consequences. General transparency obligations when collecting data still apply where a process falls outside Article 22.
In C-203/22, Dun & Bradstreet Austria, on 27 February 2025, the Court explained that the person must be able to understand and challenge the automated decision. A bare algorithm is not an adequate intelligible explanation. Claims involving trade secrets or third-party information require the competent authority or court to balance the rights involved; they do not establish a blanket refusal ground. Organisations should ensure their access-request process can obtain the necessary explanation from the relevant teams and suppliers.
Article 20 portability uses automation differently
The right to data portability requires automated processing, but it does not require a significant automated decision. It also depends on the specified consent or contractual basis and concerns personal data relating to the person that they have provided. The Article 22 threshold should not be imported into this separate right.
The EDPB’s explanation of individuals’ rights includes observed data arising from the person’s use of a service within the relevant interpretation of provided data. Inferred or derived assessments are different. A portability response therefore needs a dataset-level analysis rather than a general promise to export every internal record.
Records containing information about other people are not automatically excluded in full. Article 20 requires that portability not adversely affect their rights and freedoms, so the controller must assess the relevant effects and safeguards. Direct transmission to another controller is required where technically feasible under the provision. A paper-only activity outside portability may still be subject to access and other applicable rights.
Document the decision at the level of the activity
A useful scope assessment identifies the personal data, the operations, the automated and manual stages, any filing system, the relevant exclusions and territorial connection. It then records separate conclusions about profiling, Article 22 and portability where those issues arise. This gives each conclusion a factual basis that can be reviewed when the service changes.
The record of processing activities can point to the assessment and its supporting evidence where appropriate. If a later system update begins scoring people or automatically acting on a recommendation, the earlier conclusion should be revisited. The relationship between the AI Act and GDPR also requires separate analysis: using AI does not replace GDPR duties, and GDPR processing does not necessarily involve an AI system.
Frequently asked questions
Does a spreadsheet count as automated processing?
A spreadsheet storing or operating on personal data ordinarily involves automated processing even when information is typed manually. The overall applicability of the GDPR still depends on the data, context, exclusions and territorial rules.
Are paper files and telephone disclosures exempt?
Neither has a blanket exemption. Structured paper records can fall within the filing-system limb. Oral disclosure of data forming part of a filing system can also fall within scope, as the Endemol Shine Finland judgment explains.
Does using software mean Article 22 applies?
No. Article 22 requires a decision based solely on automated processing with legal or similarly significant effects. This narrower test must be assessed separately from the broad material-scope rules in Article 2.