GRCLibrary.ai

Register

Automated Decision-Making and Profiling Register

This register inventories automated decision-making and profiling activities subject to EU GDPR Article 22, UK GDPR Articles 22A-22D (per the UK annex; DUAA 2025 replaced Article 22, in force 2026-02-05), EU AI Act Articles 6 and 14, LGPD Article 20, PIPL Article 24, CPPA Section 63(3) (lapsed with Bill C-27), CCPA / CPRA automated decision-making rules, and equivalent provisions. It supports the transparency, human-review, and explanation rights data subjects can exercise. Under LGPD Article 20, the data subject has the right to request review of decisions taken solely on the basis of automated processing of personal data that affect their interests; the human review this register offers (item 2 under Subject rights and operating expectations) is the organization's own control and applies whether or not the governing regime requires review by a natural person.

Type
Register
Version
1.0.22
Date
2026-10-31
Owner
Data Protection Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Privacy
Review frequency
Quarterly and upon material change to any registered ADM system
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • Register schema
  • Triggers for registration
  • Subject rights and operating expectations
  • Coordination with the AI governance programme
  • Metrics
  • Framework alignment
  • Limitations

Frameworks it maps to

Related documents