Profiling
Automated processing of personal data to analyze or predict aspects of an individual's characteristics or behavior.
How the laws define this
Regulators uniformly ground profiling in the automated processing or analysis of data to evaluate, analyze, or predict personal aspects of a person, such as their behavior, preferences, performance, or characteristics. The primary distinction among these instruments lies in the scope of the target subject. Most sources—including the Datatilsynet Guidance, NPC Advisory No. 2024-04, Law No. 21.719, Safeguards Against Risks of Data Analyses by the Government (Kamerbrief), and Projet de loi organique relatif à la protection des données à caractère personnel (2025)—confine profiling strictly to personal data evaluated at the level of an individual or natural person. In contrast, AI, Public Values and Human Rights (Kamerbrief) broadens this concept to encompass analyzing data to evaluate, classify, or predict characteristics, behavior, or risks of groups as well as persons for decision-making purposes.
Synthesised from the 6 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Chile | Law No. 21.719 — Regulates the protection and processing of personal data and creates the Personal Data Protection Agency | Awaiting Entry | Adds evaluation of personal aspects like location or interests, specifies significant effects or risks that trigger mandatory DPIAs and additional safeguards. |
| Denmark | Public authorities' use of artificial intelligence: Before you start | In Force | Explains profiling in context of determining applicable lawful bases, transparency duties and limits on automated decision-making under GDPR. |
| Philippines | NPC Advisory No. 2024-04: Guidelines on the Application of the Data Privacy Act to AI Systems Processing Personal Data | In Force | Includes analysis or prediction of personal circumstances alongside behavior, preferences or performance, and addresses safeguards and bias mitigation. |
| Netherlands | Safeguards Against Risks of Data Analyses by the Government | In Force | Explicitly adopts the GDPR/AVG definition, emphasizing attendant legal protections and rights implications for government data analyses. |
| Tunisia | Organic Bill on the Protection of Personal Data (2025) | Proposed | Plain definition limited to automated processing to evaluate, analyze or predict a natural person's behavior or characteristics, adding nothing further. |
| Netherlands | AI, Public Values and Human Rights (Cabinet letter) | Adopted | Widens to automated analysis of data on groups alongside persons, classifies profiling as a central risk vector especially for discriminatory outcomes. |
What it triggers
- In Chile, profiling that generates significant effects or risks triggers mandatory DPIAs and additional safeguards under Law No. 21.719.
- Denmark's guideline explains profiling to determine applicable lawful bases, transparency duties and limits on automated decision-making under GDPR.source
- Philippines' NPC Advisory No. 2024-04 addresses safeguards and bias mitigation for profiling activities that affect data subjects.source
- Under the Netherlands' Safeguards guideline, profiling by government triggers legal protections and rights implications under GDPR/AVG.source
Definitions (6)
Processing personal data using automated means to evaluate, analyze or predict aspects about an individual (such as behaviour, preferences or performance); the guidance explains profiling to determine applicable lawful bases, transparency duties and limits on automated decision‑making under GDPR.
Automated processing to evaluate personal aspects of an individual, particularly to analyze or predict behavior, preferences, performance, or personal circumstances. The advisory requires safeguards and bias mitigation for profiling activities that affect data subjects.
Any form of automated processing of personal data intended to evaluate, analyze or predict personal aspects relating to an individual’s behaviour, preferences, location or interests, particularly where it generates significant effects or risks and may trigger mandatory DPIAs and additional safeguards under the law.
The automated analysis of data to evaluate, classify or predict characteristics, behaviour or risks of persons or groups for decision‑making purposes. The Kamerbrief treats profiling as a central risk vector—particularly when it leads to discriminatory outcomes or unfair treatment—and links it to legal safeguards such as those in data protection and administrative law.
The GDPR/AVG definition adopted by the Kamerbrief: automated processing of personal data to evaluate, analyse or predict personal aspects of an individual (e.g., behaviour, preferences or performance), with attendant legal protections and rights implications.
Any form of automated processing of personal data used to evaluate, analyze, or predict aspects of a natural person's behavior or characteristics.
Not to be confused with
Automated profiling specifies AI-driven analysis without human intervention to categorize and predict behavior, while profiling here includes any automated processing.
Automated decision systems issue scores, recommendations or decisions that affect people, whereas profiling focuses on analysis or prediction without necessarily deciding.
Questions and answers
What safeguards apply to profiling in Chile?
Law No. 21.719 requires mandatory DPIAs and additional safeguards for profiling that generates significant effects or risks.
Does profiling include group analysis?
The Netherlands' AI policy defines profiling to include automated analysis of data on groups for decision-making, unlike individual-focused definitions.
What does Philippine guidance say about profiling?
NPC Advisory No. 2024-04 addresses safeguards and bias mitigation for profiling that evaluates personal aspects and affects data subjects.
Related Terms
Automated Profiling
AI-driven analysis of personal data to categorize individuals and predict their behavior without human intervention....
Automated Decision System
A computational system (often using AI/ML) that issues scores, recommendations or decisions that assist or replace human decision-making and can materially affect people....
Right to Explanation
A legal entitlement for a person affected by an AI-driven decision to receive a clear, meaningful account of the AI system’s role and the main elements that led to that decision....
Algorithmic Transparency
The disclosure of how AI systems make decisions and process information....