Skip to main content
Privacy Track
Category: Data Subject Rights

Right to Human Intervention

Also known as: Right to Human Intervention in Automated Decision-Making, Right to Obtain Human Intervention
Simply put

The right to human intervention generally allows an individual to ask that a decision made about them by an automated system be reviewed or re-taken by a person. This means a data subject can request that a real human, rather than software alone, considers their situation. The involvement of that person is expected to be meaningful and not merely a formality.

Formal definition

The right to human intervention is a safeguard associated with automated individual decision-making, under which a data subject may request that a qualifying decision be subject to genuine human involvement, including the ability to obtain a new decision taken by a person. According to regulator guidance, to count as meaningful human intervention the controller must ensure that the oversight is substantive rather than a token gesture, which generally implies that the reviewer has the authority and competence to alter the decision. The precise scope, threshold conditions, and the boundary between decisions that trigger this right and those that do not depend on the applicable legal framework and evolving supervisory guidance, and practitioners should verify the exact statutory basis and its conditions against the current official text before relying on it.

Why it matters

As organisations increasingly rely on automated systems to make or support decisions that affect individuals, the right to human intervention functions as a check against decisions being made by software alone. It gives a data subject a route to challenge an outcome and have a person reconsider their circumstances, which matters most where automated decisions carry significant consequences for the individual. Without this safeguard, individuals could be bound by outputs they cannot question and that no accountable person has genuinely reviewed.

The practical significance turns on the word meaningful. Regulator guidance, including from the Spanish supervisory authority (AEPD), stresses that human oversight must be substantive rather than a token gesture. This implies that simply routing a case to a person who rubber-stamps the machine's output would not satisfy the right; the reviewer generally needs the authority and competence to alter the decision. For controllers, this reframes human review from a procedural formality into a substantive obligation that must be resourced and designed properly.

The exact scope of the right, the threshold conditions that trigger it, and the line between decisions that engage it and those that do not depend on the applicable legal framework and evolving supervisory guidance. Practitioners should treat this as an area subject to ongoing interpretation and verify the precise statutory basis and its conditions against the current official text before relying on it.

Who it's relevant to

Data Protection Officers and Compliance Leads
DPOs and compliance teams need to identify which automated decision-making processes may engage the right and ensure that any human review offered is genuinely meaningful rather than a rubber stamp. This includes assessing whether reviewers have the authority and competence to alter decisions and verifying the applicable statutory conditions against current guidance.
Engineers and Product Teams
Teams building or deploying automated decision systems should design workflows that allow a decision to be escalated to and re-taken by a person. Because meaningful intervention generally requires a reviewer able to change the outcome, the system architecture and process should support substantive human review rather than a purely automated pipeline.
Data Subjects
Individuals affected by automated decisions may be able to request that a person, rather than software alone, reconsider their situation and take a new decision. The availability and precise scope of this right depend on the applicable legal framework, so individuals may wish to check the specific conditions that apply to their circumstances.
Legal Advisers and Privacy Counsel
Counsel advising on automated decision-making should analyse the specific statutory basis, threshold conditions, and the boundary between decisions that trigger the right and those that do not. Given that supervisory guidance in this area continues to evolve and can vary between regulators, advice should be grounded in the current official text and relevant guidance rather than a fixed snapshot.

Inside Right to Human Intervention

Safeguard against solely automated decisions
The right to obtain human intervention arises in the context of Article 22 GDPR, which addresses decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the individual. Where such processing occurs under the limited grounds permitted, the controller must implement suitable safeguards, which generally include the right to obtain human intervention.
Meaningful human involvement
Guidance from regulators (notably the former Article 29 Working Party, whose guidance has been endorsed by the European Data Protection Board) indicates that the human review should be meaningful rather than a token gesture. In most cases this means the reviewer should have the authority and competence to change the decision, not merely rubber-stamp the automated output.
Right to express a view and contest the decision
Alongside human intervention, the recognised safeguards typically include the data subject's right to express his or her point of view and to contest the decision. Human intervention is generally treated as one element of a broader set of protections rather than a standalone remedy.
Trigger conditions and exceptions
The right is engaged where a decision meets the Article 22 threshold of being solely automated and having legal or similarly significant effects. The prohibition and its associated safeguards are subject to exceptions, such as where the decision is necessary for a contract, authorised by Union or member state law, or based on explicit consent; the precise conditions and any member state derogations should be verified against the current text.
Interaction with special category data
Where solely automated decisions rely on special category data under Article 9, additional conditions apply and the permitted grounds are typically narrower. This should be assessed separately from the general Article 6 lawful basis analysis.

Common questions

Answers to the questions practitioners most commonly ask about Right to Human Intervention.

Does the right to human intervention apply to every automated decision an organisation makes?
No. The right typically arises in connection with decisions based solely on automated processing that produce legal effects or similarly significantly affect the individual, as addressed in Article 22 GDPR. Where meaningful human involvement already forms part of the decision-making, or where the decision does not have the requisite significant effect, this specific right generally does not apply. The scope should be assessed case by case, and readers should verify the current Article 22 text and applicable regulatory guidance, as interpretation of what counts as 'solely automated' and 'similarly significant' continues to develop.
Is requesting human intervention the same as exercising the right to object or the right to erasure?
No. The right to obtain human intervention is a distinct safeguard tied to qualifying automated decision-making and is separate from other data subject rights such as the right to object or the right to erasure, which have their own conditions and legal bases. Human intervention typically involves a person with appropriate authority reviewing the automated outcome, whereas objection and erasure address whether processing continues or data is deleted. These rights may sometimes be invoked in parallel, but they should not be treated as interchangeable, and each should be handled according to its own requirements.
How should an organisation route and log a request for human intervention?
Organisations generally establish a defined intake channel and record the request, the date received, and the automated decision at issue. It is typically advisable to identify who is responsible for handling such requests and to document the review steps taken. Retention and logging practices should align with the organisation's broader accountability and records obligations. The specific handling timeframe and procedural detail should be checked against the current GDPR text and any applicable national implementing law or regulatory guidance, as these can vary.
Who within an organisation is qualified to carry out the human review?
The reviewer should generally be a person with appropriate authority and competence to assess the decision and, where warranted, to change the outcome, rather than someone who merely rubber-stamps the automated result. The aim is meaningful review rather than a nominal one. Organisations typically consider the reviewer's understanding of the relevant factors, access to necessary information, and ability to act on the review. The precise standard for what constitutes meaningful human involvement continues to be shaped by regulatory guidance and should be verified against current sources.
What information should an individual receive when they exercise this right?
In most cases the individual can expect the outcome of the human review and, depending on the circumstances and applicable transparency obligations, relevant information about how the decision was reached. This connects to broader duties to provide meaningful information about the logic involved and the significance and envisaged consequences of the processing. The exact scope of information to be provided is subject to assessment and may be affected by other considerations such as third-party rights or trade secrets, so organisations should confirm the position against the current text and guidance.
How does the right to human intervention interact with special category data used in automated decisions?
Where qualifying automated decisions involve special category data under Article 9, an additional Article 9 condition is generally required alongside the relevant Article 6 basis, and the availability of solely automated decision-making in that context may be more constrained. Organisations should assess whether the processing is permitted at all before considering the mechanics of human intervention. Because member state derogations can vary the position and interpretation is still developing, the specific requirements should be verified against the current GDPR text and applicable national law.

Common misconceptions

Any use of automation in decision-making triggers the right to human intervention.
The right is generally engaged only where a decision is based solely on automated processing and produces legal or similarly significant effects. Processing where a human already exercises genuine, meaningful influence over the outcome typically falls outside the strict Article 22 threshold, though this depends on assessment of the specific facts.
Providing a human reviewer is sufficient to satisfy the requirement.
Regulatory guidance indicates the involvement must be meaningful. A reviewer who merely confirms the automated output without the authority or competence to alter it is generally not regarded as adequate human intervention.
Human intervention is the only safeguard the controller must provide.
Human intervention is typically one of several safeguards. The recognised measures generally also include the right to express one's point of view and to contest the decision, and this sits alongside broader transparency and information obligations.

Best practices

Assess whether each relevant decision genuinely meets the Article 22 threshold of being solely automated with legal or similarly significant effects, and document that assessment rather than assuming the right does or does not apply.
Design human review so it is meaningful: assign reviewers who have the authority, competence, and access to relevant information needed to genuinely alter the outcome.
Implement the full set of associated safeguards together, including clear routes for the data subject to express their view and to contest the decision, not human intervention in isolation.
Give particular attention to any automated decisions that rely on special category data, as narrower conditions generally apply and should be evaluated separately.
Provide clear, accessible information to data subjects about how to invoke human intervention and how such requests are handled.
Verify the current statutory conditions, exceptions, and any applicable member state derogations against the official GDPR text (and UK GDPR where relevant), as the position can vary by jurisdiction.