Profiling, as defined in Article 4(4) of the GDPR, is any form of automated processing of personal data that involves using that data to evaluate certain personal aspects of a natural person. This includes analysing or predicting aspects concerning an individual's work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.
The GDPR imposes specific safeguards on profiling, particularly when it produces legal effects or similarly significantly affects individuals. Article 22 gives data subjects the right not to be subject to decisions based solely on automated processing, including profiling. Organisations engaged in profiling must ensure transparency about the logic involved, implement appropriate safeguards including the right to human intervention, and conduct data protection impact assessments for high-risk profiling activities.