Compliance guide, checked 8 November 2026
Automated decisions and the Privacy Act: getting ready for 10 December 2026
Last updated
What APP 1.7 to 1.9 require, which decisions count, and a six-step checklist for the people who have to make it happen before the deadline. This page is general information, not legal advice.
The short answer
From 10 December 2026, your privacy policy must say when a computer program makes, or substantially helps make, decisions that could significantly affect people. The rule sits in Australian Privacy Principle 1, as new APP 1.7, 1.8 and 1.9, added by the Privacy and Other Legislation Amendment Act 2024.
It is a transparency rule. It does not ban automated decisions. It applies to systems already running on that date, not only new ones. Writing the paragraph is quick. Finding every automated decision across your systems and vendor tools is the slow part.
When the rule applies
Three tests must all be met. First, you have arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision. Second, the decision could reasonably be expected to significantly affect the rights or interests of an individual. Third, personal information about that individual is used in the operation of the program.
A computer program is broad. The OAIC lists pre-programmed rule-based processes, AI and machine learning, software, apps and word-processing tools, and generative AI including chatbots. Its own worked example shows a spreadsheet formula is enough. You have arranged for a program if you built it, bought it, configured off-the-shelf software or rely on its advisory output.
A decision includes refusing or failing to make one. If a ranking is used to decide who not to contact, that is still in scope.
What your privacy policy must say
The kinds of personal information used
Describe the categories the programs use, such as identity details, employment history, credit information or location. Call out sensitive information, such as health information or biometric templates, clearly.
The kinds of decisions made solely by a program
For example, approving or declining a credit application with no person involved.
The kinds of decisions a program substantially and directly informs
For example, a candidate shortlist or risk score that a person then relies on to decide.
How much detail
Categories, not code. You may group decisions and information, but the result must be meaningful to a reasonable person. Commercially sensitive information and trade secrets are excluded, but embarrassment is not a reason to leave something out.
What the key terms mean
Significantly affect rights or interests
The OAIC says the effect must be more than trivial and able to considerably influence a person's circumstances. It counts whether the effect is adverse or beneficial. APP 1.9 gives examples: granting or refusing a benefit under a law, affecting rights under a contract or arrangement, and affecting access to a significant service or support. Impact on people experiencing vulnerability weighs more.
Substantially and directly related
Substantially means the program's output is a key factor in the human's decision. Directly means it has a direct connection with making the decision. Output can be in scope whether it is advisory or determinative.
Human review
A person signing off does not take a decision out of scope. The OAIC says machine learning or generative AI outputs used in significant decisions will generally be in scope unless subject to extensive human oversight and control, such as interrogating the output, using other evidence and recording why the person departed from it.
Vendors
The obligation stays with the organisation using the program to decide about people. The OAIC expects software providers to give clear, high-level information so their customers can write the disclosure.
Who it applies to
It applies to every APP entity. That includes Australian Government agencies, organisations with annual turnover above 3 million dollars, health service providers, credit reporting bodies and contracted service providers to the Commonwealth. State and local government agencies follow their own state privacy laws, though their suppliers may be bound by contract.
Inside a multi-site organisation, no single team sees every automated decision. The privacy officer owns the policy. IT and application managers know which systems hold decision logic. HR systems leads own candidate screening and performance tools. Finance systems teams own credit and collections rules. Operations owns job allocation and rostering. All of them need to be in the room.
Examples by industry
Recruitment and labour hire
Likely in scope. The OAIC names recruitment software that sorts candidates and AI video interview scoring as examples, and treats targeted job advertising that limits who sees a role as affecting access to work.
Field services
Assess. Job allocation that decides which workers or contractors get work, and so what they earn, can affect rights under a contract. Route planning that does not change anyone's work or pay is unlikely to count.
Wholesale and trade credit
Assess. Credit limits for a company are not about an individual, but in scope where the program uses personal information about a director, guarantor or individual account holder to set or refuse credit.
Insurance and finance
Likely in scope. Programs that approve or reject loan or credit applications, assess insurance eligibility, or block accounts and transactions on fraud flags are all named in OAIC guidance.
Government services
Likely in scope. Programs that determine eligibility for a benefit, housing, health or disability services, education or a grant are named in OAIC guidance, even where staff make the final call.
Example AI uses and whether disclosure is likely needed
| AI or automated use | Disclosure likely needed? | Why |
|---|---|---|
| Ranking or shortlisting job applicants | Yes | Affects access to employment. Named by the OAIC. |
| Scoring recorded video interviews | Yes | Affects access to employment and may use biometric information, which should be called out. |
| AI reports used for performance ratings, promotions or bonuses | Yes | A key factor in pay decisions, even with manager and director sign-off. |
| Automated loan or credit approval and decline | Yes | Affects rights under a contract. Named by the OAIC. |
| Insurance eligibility assessment | Yes | Affects access to a significant service. Named by the OAIC. |
| Fraud rules that block an account or transaction | Yes | Grants or denies access to a service. |
| Spreadsheet formula that ranks clients for service priority | Yes | The OAIC's Example 1 is a spreadsheet that ranks clients for health and aged care services. |
| Allocating jobs or shifts to workers | Assess | In scope where it decides who gets work or pay. Check how far staff rely on the output. |
| Trade credit limits for business customers | Assess | In scope where personal information about a director, guarantor or individual is used. |
| Vehicle route optimisation | Unlikely | No significant effect on an individual's rights or interests. |
| Generative AI drafting internal documents | Unlikely | No decision about a person. Becomes in scope if the draft drives a decision about someone. |
| Demand forecasting on aggregate data | Unlikely | No personal information used. |
Readiness checklist
Inventory automated decisions
List decisions, not systems: shortlist a candidate, set a credit limit, allocate a job. Include vendor features switched on by default and team-built spreadsheets.
Assess significance
For each decision, test whether it could significantly affect a person's rights or interests, and how far staff rely on the output. Record why anything is out of scope.
Map personal information
Record the kinds of personal information each program uses. Flag health, biometric and other sensitive information. Ask vendors for what you cannot see.
Update the privacy policy
Add a plain-English section covering the kinds of information used and the kinds of decisions made solely or substantially by programs. Publish it before 10 December 2026.
Keep a person accountable
Name an owner for each in-scope decision. Where you rely on human review, make it real: staff check the output, use other evidence and record when they depart from it.
Log and review
Keep the inventory current. Review it when systems change, vendors upgrade or new AI features go live, and at least once a year.
What happens if you miss the deadline
The OAIC can act on a privacy policy that falls short. Since December 2024 the OAIC can issue infringement and compliance notices for some privacy policy failures. Check with your adviser which apply to APP 1.7 and 1.8. More serious interferences with privacy can attract civil penalties.
The larger risk is usually a complaint or inquiry that exposes automated decisions you had not documented, followed by fixing them under scrutiny.
How Solve8 helps
We run an automated decision inventory with your privacy officer, IT, HR, finance and operations leads, then review your privacy policy wording against APP 1.8. You get a register of in-scope decisions with owners, and draft wording for your legal team to approve.
Sources
This page is general information, not legal advice. Confirm your position with your legal adviser.
OAIC, APP 1.7-1.9 Transparency Obligation Fact Sheet, September 2026: https://www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF
OAIC, New resources on transparency for use of AI and automated decision making, 30 September 2026: https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making
OAIC, APP Guidelines Chapter 1, Open and transparent management of personal information, September 2026: https://www.oaic.gov.au/__data/assets/pdf_file/0027/269064/APP-Guidelines-APP-1-Open-and-transparent-management-of-personal-information-September-2026-v2.pdf
Privacy and Other Legislation Amendment Act 2024 (Cth), as made: https://www.legislation.gov.au/C2024A00128/asmade
Allens, Mandatory automated decision making disclosure requirements are coming: key takeaways from the OAIC guidance, October 2026: https://www.allens.com.au/insights-news/insights/2026/10/mandatory-automated-decision-making-disclosure-requirements-are-coming-key-takeaways-from-the-oaic-guidance/
HWL Ebsworth, Privacy reforms: new rules for using technology to automate or assist with decision making: https://hwlebsworth.com.au/privacy-reforms-new-rules-for-using-technology-to-automate-or-assist-with-decision-making/
Lander and Rogers, Australian privacy law update: what APP entities need to know in 2026, February 2026: https://landers.com.au/legal-insights-news/australian-privacy-law-update-what-app-entities-need-to-know-in-2026
Questions
When do the automated decision making rules start in Australia?
10 December 2026. From that date, APP entities must describe in their privacy policy the computer programs that make, or substantially and directly inform, decisions that could significantly affect people. The rule covers systems already running on that date, not only new ones.
Does a person signing off take a decision out of scope?
Usually not. The OAIC says a decision is still covered when a computer program's output is a key factor and a person approves it without extensive oversight and control. A quick sign-off on a system recommendation is likely to be in scope. Extensive review may take it out of scope. That means the person interrogates the output, checks the underlying data, uses other evidence and records why they departed from the recommendation. Being able to override the result is not enough on its own.
Does AI candidate screening need to be disclosed?
Yes, in most cases. The OAIC names recruitment software that sorts candidate profiles, and AI scoring of video interviews, as in scope because they affect access to employment. Disclose the kinds of information used, such as resumes and interview responses, and call out any biometric information.
Does the rule cover spreadsheets and rules engines, or only AI?
It covers all of them. The OAIC says a computer program includes rule-based processes, machine learning, software, apps and word-processing tools, and generative AI. Its Example 1 treats a spreadsheet formula that ranks people for health and aged care services as in scope. A spreadsheet formula that ranks people for a service can trigger the rule as readily as an AI model.
What happens if we do not update our privacy policy?
The OAIC can issue infringement and compliance notices for some privacy policy failures, without going to court, so check with your adviser which apply to APP 1.7 and 1.8. More serious interferences with privacy can lead to civil penalty proceedings. A complaint can also prompt an OAIC inquiry into the decisions themselves.
Who should own automated decision disclosure in our organisation?
The privacy officer owns the privacy policy, but cannot find the decisions alone. IT, HR systems, finance systems and operations leads each hold part of the picture, so each in-scope decision should have a named business owner who keeps its entry current.
Related
Australian AI rules and deadlinesA dated tracker of the laws, policies and guidance that change what Australian organisations must do with AI, each checked against its official source.
AI strategyWhat to fix first, and the business case.
Financial servicesControls, reporting and reconciliations.
SecurityYour data stays in your environment.
Find your automated decisions before 10 December
We can run the inventory with your privacy officer and review your privacy policy wording before the deadline.
Fixed-fee phases, agreed before we start. Stop after any phase.