Automated Decision-Making
Decisions made by software with little or no human involvement.
Automated decision-making means software decides something about a person, such as approving a loan or screening a CV, with little or no human review.
Meaning of Automated Decision-Making
GDPR gives rights against solely automated decisions. The DPDP Act has no such standalone right, but fiduciaries must keep data accurate and complete where it is used for decisions, and Significant Data Fiduciaries must verify that algorithms do not risk Data Principals' rights.
The European GDPR has a dedicated provision, Article 22, giving people a right not to be subject to solely automated decisions that significantly affect them, usually with a right to human review. The DPDP Act has no equivalent standalone right. Nothing in it says "you may not decide by algorithm". Instead, the Act regulates automated decisions through duties that apply to all processing, and two that bite particularly hard when a machine is making the call.
The first is Section 8(3). Where personal data is likely to be used to make a decision that affects the Data Principal, the fiduciary must make reasonable efforts to ensure that the data is complete, accurate and consistent. This is the legal hook for most automated-decision disputes: if a scoring model rejects a person because an old, wrong or merged record was fed into it, the failure is a failure of data accuracy by the fiduciary. Section 8(1) adds that the fiduciary remains responsible for processing carried out by a Data Processor on its behalf, so outsourcing the model to a vendor does not shift the responsibility.
The second is Rule 13, which applies to Significant Data Fiduciaries. Besides an annual Data Protection Impact Assessment and audit, they must exercise due diligence to verify that algorithmic software they use for hosting, display, uploading, publishing, sharing and similar operations on personal data is not likely to pose a risk to Data Principals' rights. Large lenders, social platforms and marketplaces that rely on ranking, recommendation or moderation engines should read that as a mandate to test their models.
Individual rights also matter. A Data Principal can ask for a summary of the personal data being processed and the identities of those with whom it has been shared (Section 11), seek correction and erasure (Section 12), and use grievance redressal (Sections 8(10) and 13) and then the Board if the answer is unsatisfactory. These rights give a person a way to find out what data fed a decision and to fix it. Sector regulators, such as the RBI for digital lending, may add their own expectations about explanation and human oversight, and Section 38 makes the DPDP Act additional to those.
Examples of Automated Decision-Making
A lending app rejects applications using a model. The lender must make sure the data it uses is accurate and complete.
A lending app uses a model to approve small loans. After a customer disputes a refusal, the lender finds that an old default record belonged to another person with a similar name. It corrects the record, re-runs the decision and tightens its matching rules.
A company screens CVs with software that ranks candidates. The HR head requires a human to review every rejection, tests the tool for gaps against women returning from career breaks, and keeps the records for audit.
An aggregator's tool suggests policies and sets eligibility from health declarations. It shows the applicant which answers drove the result and lets her correct a wrongly entered answer before the quote is final.
Why Automated Decision-Making matters
Automated decisions are efficient and also easy to get wrong at scale. A flawed rule can reject thousands of applicants before anyone notices, and each rejection may produce a complaint. A breach of the Act's general obligations can attract a penalty of up to ₹50 crore, and a Significant Data Fiduciary that neglects its Rule 13 duties faces a ceiling of ₹150 crore. Beyond penalties, regulators of credit, insurance and employment expect fairness, so a model that cannot be explained becomes a business risk.
For individuals, an automated rejection can be hard to challenge because the reasons are hidden. The route is through access, correction and grievance rights, so organisations that give clear answers and meaningful review are better placed to retain trust.
How it works in practice
- 1List every decision your systems make or heavily influence: credit approval, fraud flags, insurance pricing, CV screening, content moderation, account suspension. Identify which are fully automated and which have a human reviewer.
- 2Check the data feeding each model. Set rules for freshness, deduplication and source quality so that Section 8(3) is met, and add a flag for records the Data Principal has disputed.
- 3Build a human-review path for adverse decisions with significant effects, such as loan refusals and account closures. It is not mandated by the Act, but it is the most practical way to demonstrate accuracy and fairness.
- 4Explain the decision in plain language. Record the main factors used and give the person a channel to ask questions and request correction under Section 12.
- 5If you are or may become a Significant Data Fiduciary, schedule the annual audit and algorithmic due diligence under Rule 13, test models for bias and error rates, and keep the results on file.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Thinking the Act is silent, so anything goes. Section 8(3) accuracy duties and Section 8(1) responsibility for processors apply to automated decisions.
Blaming the vendor. A fiduciary stays responsible for a processor's model. Put testing rights and audit access in the contract.
Feeding unverified data into models. Weak data hygiene is the commonest cause of unfair automated outcomes.
Offering no way to challenge a result. Even without a GDPR-style right, silence invites complaints to the Board. Provide a correction and review channel.
Compliance tips
Keep a model inventory with owner, purpose, inputs, version and last test date.
Log decisions and input data for a defined period so you can reconstruct why a person was refused. Align log retention with the Rules' minimum one-year requirement.
Run periodic fairness checks across groups relevant to your sector and document corrective changes.
Train front-line staff to recognise and escalate complaints that look like automated errors.
Common questions about Automated Decision-Making
Does the DPDP Act have a right against automated decisions like GDPR Article 22?
No. The Act contains no standalone right to object to solely automated decisions. It does require fiduciaries to ensure data used for decisions is complete, accurate and consistent under Section 8(3), and gives access, correction and grievance rights.
Who is responsible if my vendor's algorithm makes a wrong decision?
You are, as the Data Fiduciary. Section 8(1) makes the fiduciary responsible for processing done on its behalf by a Data Processor. Use contracts, testing and audit rights to manage the risk.
Do I need a human to review automated decisions in India?
The DPDP Act does not require it generally, but some sector regulators set their own expectations. Human review of adverse decisions is a sensible control and helps demonstrate accuracy. Check your regulator's directions.
What extra duties apply to Significant Data Fiduciaries?
Rule 13 requires an annual Data Protection Impact Assessment and audit, due diligence that algorithmic software does not risk Data Principals' rights, and compliance with any data-localisation conditions the Government specifies.