When a decision is made about you

Everything so far has been AI you use. This is AI used on you — and it is where the stakes are highest and the general awareness lowest.

Where it happens

You will meet automated decisions in ordinary life:

Job applications screened before a person sees them.
Credit, loans and insurance — scored, priced, declined.
Benefits and public services — eligibility, fraud flags, prioritisation.
Banking — transactions blocked, accounts frozen for suspicious activity.
Platform moderation — content removed, accounts suspended.
Tenancy and background checks.
Education — admissions, proctoring, grading tools.

Most are not announced as AI. You receive an outcome, and the reasoning is not included.

What rights generally exist

Specifics vary by country and this is not legal advice — but a common pattern runs through many modern data protection regimes, including the EU/UK GDPR and India’s DPDP framework.

Not to be subject to a solely automated decision producing legal or similarly significant effects, with exceptions — and where an exception applies, safeguards including human involvement.

To be told that automated decision-making occurred, and something meaningful about the logic.

To obtain human intervention, express your point of view, and contest the decision.

To have inaccurate data corrected — frequently the actual problem, because a decision made on wrong information is wrong regardless of how good the system is.

Sector rules often add more: financial regulators, employment law, education regulators.

How to ask, so it works

The wording matters more than people expect. Vague dissatisfaction gets a form letter; a specific request gets routed to someone who must answer.

Ask, in writing:

1. Was this decision made solely or partly by automated means, including any profiling or scoring?

2. If so, what were the main factors, and what information about me was used?

3. I request human review of this decision, and I would like to give my side.

4. Please confirm what personal data you hold about me in relation to this, so I can check it is accurate.

Writing matters because it starts a formal clock in most regimes, creates a record, and reaches the team whose job is to answer rather than the phone queue.

Be factual and unemotional. E8·L7’s refusal advice applies: one clear request, specific, no threats — the person reading it usually did not make the decision and can help you more if you make it easy.

Correct the data first

Often the fastest route to a different outcome.

Automated decisions run on data, and that data is wrong more often than organisations assume: an old address, a mismatched name (E10·L5), a duplicate record, someone else’s debt, an unclosed account.

Ask what they hold before arguing about the judgement. If the input was wrong, you do not need to challenge the system at all — you need it re-run.

If review does not come

Escalate in order: the organisation’s formal complaints process, then the relevant regulator — data protection authority, financial ombudsman, education regulator — and, where a decision is serious and unresolved, legal advice.

Regulators generally require you to have complained to the organisation first, so keep the correspondence.

The honest limits

Two things worth being straight about.

Rights on paper are not always rights in practice. Organisations vary in how well they respond, and pursuing this takes persistence people do not always have.

And thresholds matter: “legal or similarly significant effects” is doing real work in that phrasing. A recommendation algorithm choosing your feed is not the same category as a mortgage refusal.

Knowing the right question is still worth a great deal, because most people never ask, and organisations behave differently with someone who has.

Try it now (5 minutes)

Think of one decision made about you in the last year where you never learned the reasoning — a rejection, a price, a limit.

Write the four questions as you would send them. You may never send it; drafting it once means you will recognise the situation, and know the wording, when it matters.

Check your understanding

1. The core right in many data protection regimes concerns: Any use of AI by an organisation Solely automated decisions with legal or similarly significant effects Only decisions about employment

2. The fastest route to a different outcome is often: Challenging the algorithm's design Checking and correcting the data the decision was based on Reapplying immediately

3. Requests should be made in writing because: Phone staff are not permitted to help It starts a formal clock, creates a record, and reaches the team who must answer Verbal requests are not legally valid

Recap

Automated decisions reach you through hiring, credit, benefits, banking, moderation and education, and are rarely announced. Most modern regimes give you rights to be told, to obtain human review, to contest, and to correct inaccurate data — and correcting the data is often the fastest fix. Ask in writing with four specific questions, escalate to the complaints process and then the regulator, and know that the threshold and the practice both have real limits.