If you’re using personal data to automate choices about people, your processes need to demonstrate both technical diligence and legal awareness.