Skip to content
Digital Thread

Automated decision-making: your right to a human decision

Section 49 of the Data Protection Act, 2024 gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal effects or similarly significant effects on them.

Section 49 of the Data Protection Act, 2024 gives a data subject the right not to be subject to a decision that is made by a machine alone, where that decision has a real effect on them. It targets decisions with nobody actually deciding, not every use of an algorithm or a scoring system.

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her. (s.49(1))

What this looks like in practice

Two examples make the shape of this right clear. An automated credit-scoring system that approves or denies a loan application with no person reviewing the outcome is exactly what section 49 is aimed at: a machine decision that has an obvious legal and financial effect on the applicant. An algorithm that automatically screens out and rejects job applications before a person ever looks at them is the same problem in a hiring context: a significant decision about someone’s opportunities, made without human involvement.

When it is allowed anyway

Section 49(2) sets three situations where the right in subsection (1) does not apply:

  • The decision is necessary for entering into, or performing, a contract between the data subject and the controller.
  • It is based on the data subject’s explicit consent.
  • It is authorised by law.

Even where the contract or consent route applies, the Act does not leave the data subject with nothing. Section 49(3) requires the controller to put suitable measures in place to safeguard the data subject’s rights, including the right to get a human being to intervene, the right to express a point of view, and the right to contest the decision. In other words, a business cannot rely on “you agreed to it” or “it was in the contract” as an excuse to run a fully automated process with no way for the affected person to push back.

Where this fits with objecting to processing

Automated decision-making and the right to object often come up together, particularly where profiling is involved. Objecting to the underlying processing is one route; challenging a specific automated decision after it has been made under section 49 is another, and the two are not mutually exclusive.

Educational information only, not legal advice. Source: Data Protection Act, 2024 (Act No. 18 of 2024), s.49. Last reviewed: 7 September 2026.

Questions about automated decision-making: your right to a human decision

No, not on its own. Section 49(1) only applies where the decision is based solely on automated processing. If a person actually reviews the output and makes the final call, it is not a decision the section covers.
Consent is one of the exceptions in section 49(2), but for the contract and consent routes, section 49(3) still requires the controller to build in safeguards, including your right to get a human to look at it, say your piece, and contest the outcome.
It is covered where the score alone drives the outcome, such as a loan being approved or denied with no person involved. Where a loan officer reviews the score and makes an independent decision, the automated element is only an input, not the decision itself.