← CCPA/CPRA · Regulations (2026+)
Regs (ADMT) — Automated decision-making technology for significant decisions
Requirement
From 1 January 2027, a business that uses automated decision-making technology to make significant decisions about consumers (financial or lending, housing, education, employment or healthcare) must give a pre-use notice, offer a right to opt out (or a qualifying human appeal) and respond to requests for access to information about the ADMT's use.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.15 | Right of access | data-subject-rights |
| GDPR | Art.18 | Right to restriction of processing | data-subject-rights |
| GDPR | Art.20 | Right to data portability | data-subject-rights |
| GDPR | Art.22 | Automated decision-making and profiling | data-subject-rights |
| NDPA 2023 | s.34(1)(a)-(c) | Right of access and rectification | data-subject-rights |
| NDPA 2023 | s.38 | Right to data portability | data-subject-rights |
| NDPA 2023 | s.36-37 | Objection and automated decision-making | data-subject-rights |
| GDPR | Art.12 | Transparent communication and handling of rights requests | data-subject-rights |