European UnionI was subject to an automated decision that denied me a loan. Can I challenge it?
Yes, you can challenge an automated loan decision under the GDPR if it produces legal effects or significantly affects you — you have the right to human review and an explanation.
What the Law Says
The General Data Protection Regulation (GDPR) gives you strong protections against fully automated decisions that affect you legally or significantly — like a loan denial.
Under Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing — including profiling — if that decision produces legal effects concerning you or similarly significantly affects you.
This means if a bank or lender used only algorithms (no human involvement) to deny your loan application, and that denial has real consequences (e.g., credit denial, financial exclusion), the decision likely falls under Article 22.
You are entitled to obtain human intervention, express your point of view, and contest the decision. The controller must also provide meaningful information about the logic involved and the significance and envisaged consequences of the processing.
Statutory TextThe data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
— Regulation (EU) 2016/679, Art. 22(1) — Automated individual decision-making, including profiling
Statutory TextThe controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
— Regulation (EU) 2016/679, Art. 22(3) — Safeguards for automated decision-making
What to Do
Contact the lender in writing (email or letter) and request human review of the decision under GDPR Article 22.
Ask for an explanation of the logic, criteria, and data used — including any profiling — in plain language.
If unsatisfied, lodge a complaint with your national Data Protection Authority (e.g., CNIL in France, ICO in UK pre-Brexit, or national DPA in your EU country).
You may also seek judicial remedy in national courts within one year of becoming aware of the violation.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.