Profiling

What it means

Under the GDPR, profiling is any form of automated processing of personal data used to evaluate personal aspects of an individual, in particular to analyse or predict their work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. The key element is evaluation, not merely collecting data.

Profiling is not prohibited as such. It is a normal part of marketing, credit assessment, fraud prevention and HR. It must, however, have a legal basis, such as legitimate interest or consent, and the company must inform data subjects about it transparently. People have the right to object to profiling for marketing purposes.

Stricter rules apply to decisions based solely on automated processing, including profiling, that produce legal effects for a person or similarly significantly affect them, such as automatic refusal of a loan or job application. Such decisions are allowed only exceptionally, and the person has the right to human intervention, to express their view and to contest the decision.

How it works in practice

In marketing, profiling is used in customer segmentation, personalised recommendations, lead scoring and automated campaigns. The company should state in its privacy notice what data it uses for profiling, for what purpose and how people can object. Targeted advertising via cookies requires consent.

Extensive or sensitive profiling calls for a data protection impact assessment. It is mandatory in particular for systematic and extensive evaluation of personal aspects on which decisions with significant effects are based, or for profiling vulnerable people. The assessment helps uncover risks before the system goes live.

In HR, profiling appears in automated CV screening, performance evaluation and employee monitoring. Extra care is needed here because employees are in a weaker position and their consent is often not freely given. For AI-based tools the rules of the European AI Act also need to be considered.

What to watch out for

The most common mistake is profiling without realising it, for example through third-party analytics and advertising tools. A company that shares data with ad platforms becomes jointly responsible for how it is used. Knowing where data goes and how it is evaluated is the foundation of GDPR compliance.

Watch out for bias and discrimination. An algorithm trained on historical data can unintentionally disadvantage certain groups, for example by age, sex or place of residence. For decisions affecting people, results should be checked regularly and there should be a procedure to correct a wrong decision.