The organization should identify the statutory obligations concerning data subjects in relation to decisions concerning data subjects that are based on automated processing (e.g. notifying the data subject of automated decision-making) and ensure that these requirements are met in its own operations.