Automated decisions: what your privacy policy must say by 10 Dec

From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when a computer program makes, or substantially helps make, decisions that significantly affect people. This guide explains the three tests, shows how to inventory your automated decisions and gives an example of policy wording.

General information, not legal advice. Check your own situation with a privacy lawyer.

What changes on 10 December 2026?

Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024 ("Automated decisions and privacy policies") commences on 10 December 2026, two years after Royal Assent. It adds three subclauses to Australian Privacy Principle 1. APP 1.7 says your APP privacy policy must contain the information in APP 1.8 if:

1. you have arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and
2. the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
3. personal information about that individual is used in the operation of the program to make the decision or do that thing.

APP 1.8 then requires the policy to set out:

• the kinds of personal information used in the operation of those programs;
• the kinds of decisions made solely by those programs; and
• the kinds of decisions where the program does a thing that is substantially and directly related to making the decision.

APP 1.9 adds that making a decision includes refusing or failing to make one, that effects can be adverse or beneficial, and gives three examples of decisions that may affect rights or interests: granting or refusing a benefit under a law, decisions affecting rights under a contract or arrangement, and decisions affecting access to a significant service or support.

Two details matter for planning:

• It isn’t only for new systems. The application provision says the change applies to decisions made after commencement, whether the arrangement with the program, the use of personal information, or the collection of that information happened before or after 10 December 2026.
• It has teeth. The same Part adds APP 1.7 to section 13K of the Privacy Act, the civil penalty provision listing APP breaches for which infringement notices or compliance notices can be issued. Section 13K sets a maximum penalty of 200 penalty units per contravention.

Does it apply to your organisation?

It applies to "APP entities": Australian Government agencies and most organisations with annual turnover above A$3 million. Smaller businesses are usually exempt under the Privacy Act’s small business rules, but not if, for example, they provide a health service and hold health information, trade in personal information, are a contracted service provider for a Commonwealth contract, or are related to a larger business. Our guide to the Notifiable Data Breaches scheme walks through those coverage rules in more detail.

If you’re unsure, the OAIC’s fact sheet says entities in doubt "should take a cautious approach" and include the information.

How does the OAIC read the three tests?

On 30 September 2026 the OAIC released an APP 1.7-1.9 fact sheet, a flowchart, a supplementary fact sheet for agencies, and updated APP 1 guidelines. These points from the fact sheet change the most for small and mid-sized organisations.

"Computer program" covers more than AI

The fact sheet lists pre-programmed rule-based processes, artificial intelligence and machine learning, "software, apps or word-processing tools", and generative AI, including chatbots. Its first worked example is a health and aged care provider whose spreadsheet formula scores and ranks clients for follow-up. The OAIC treats that spreadsheet as in scope, and says it would still be in scope if staff used the ranking to decide whom not to contact.

You have "arranged for" a program if you built it, bought it, configured off-the-shelf software, authorised it to decide, or rely on its advice. Buying a SaaS product doesn’t move the obligation to the vendor. The OAIC generally expects the obligation to stay with the organisation making the decision, and says software providers should give clear, high-level information about how their products can be used to make decisions, so customers can write their policies.

"Substantially and directly" includes advice a human follows

"Substantially" means the program is a key factor in the human’s decision. "Directly" means it has a direct connection with making the decision. A program can meet the test if it advises an outcome, determines it, or "in any other way influences" it.

The fact sheet says a decision may be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review". It also says machine learning or generative AI outputs used to make significant decisions "would generally fall within scope… unless subject to extensive human oversight and control".

Its example is a sales team whose managers use a generative AI tool to suggest bonuses. Director sign-off on every decision did not take it out of scope, because the AI’s recommendation was a key factor. What might change the answer: staff interrogating outputs, reviewing the underlying indicators, narrowing the tool’s parameters, using additional evidence, and documenting why they departed from its recommendation.

"Significantly affect" means more than trivial

The impact must be more than trivial and have the potential to considerably influence a person’s circumstances. Vulnerability counts: a decision can be significant for someone experiencing vulnerability even if it wouldn’t be for most people. The OAIC’s pricing example finds that small personalised price differences on essential goods are significant because they compound over time.

Which decisions are likely to be in scope?

The OAIC’s non-exhaustive list of decisions that would generally be in scope includes:

• recruitment software that sorts candidate profiles and informs hiring;
• AI-generated reports used to rank employee performance, decide promotions or set bonuses;
• approving or rejecting a loan or credit application;
• assessing eligibility for insurance;
• prioritising health or disability services;
• eligibility for housing assistance, government benefits, education or training programs, scholarships or grants;
• facial recognition for watchlist matching in a store or stadium;
• personalised pricing and programmatic advertising for significant goods or services.

For a typical organisation with 20 to 500 staff, the places to look are less obvious. A common example is a recruitment platform that auto-rejects applicants who answer a knockout question "wrong", or scores video interviews. Others include an accounts system that sets credit limits or payment terms automatically, a fraud or identity rule that locks a customer’s account, a tenancy or membership platform that screens applicants, a rostering tool that allocates shifts (and therefore income) to casual staff, and a client triage spreadsheet in a health, disability or community service.

Less likely to meet the "significantly affect" test on their own: a spam filter, spell check, meeting scheduling, or a chatbot that answers general questions. Test each one anyway; a chatbot that decides who gets a callback, or a filter that silently drops job applications, is different.

How to find automated decisions in your organisation

Step 1: List the decisions, not the software. Ask each team lead what decisions you make about customers, clients, applicants, members, staff or volunteers: approve, reject, prioritise, price, rank, refer, suspend, enrol, pay.

Check: you have decisions from HR and recruitment, finance and credit, customer service, and any client-facing service teams, not just IT.

Step 2: For each decision, ask what software touches it. Include SaaS platforms, spreadsheets with formulas, automation rules, scoring features turned on by default, and anything using AI, including staff using public AI tools to summarise or rank people.

Check: you have asked "does anyone paste applicant, client or staff details into an AI tool to help decide?" Unapproved AI use is common and won’t show up in your software register.

Step 3: Record what personal information each program uses. Use categories (identity, contact, financial, employment, health, biometric, location, behavioural). Flag sensitive information clearly; the OAIC says it should be clear in the policy where more sensitive types such as health information or biometric templates are used.

Step 4: Classify each decision. Is it made solely by the program, or does the program do something substantially and directly related to a human’s decision? Or is the program’s role minor, with extensive human oversight you can show?

Check: if you’re relying on "a human reviews it", you can point to written evidence that staff interrogate the output and document departures, not just a sign-off.

Step 5: Ask vendors. For each platform in scope, ask the vendor for a plain-English description of how its features use personal information to make or inform decisions. The OAIC says software providers should give their customers clear, high-level information of this kind.

Step 6: Decide and record. Record your conclusion and reasoning for each row, including those you decide are out of scope.

Inventory template

Copy this into a spreadsheet. One row per decision.

What should the privacy policy say?

The OAIC asks for information that is meaningful to a reasonable person without unnecessary technical detail. You can group decisions and information types, but should tailor the wording to your activities and let people ask for more. Trade secrets and commercially sensitive information are excluded; the fact that you use a program for significant decisions is not.

A simple structure that maps to APP 1.8:

1. A heading people can find, such as "Decisions made by computer programs".
2. For each group of decisions: the kinds of personal information used.
3. The kinds of decisions made solely by computer programs.
4. The kinds of decisions where computer programs substantially and directly help a person decide.
5. How to ask questions or seek a review (this isn’t one of the three APP 1.8 items, but the OAIC encourages framing the information so the decision can be reviewed).

Example wording

Example only. This is an illustration for a fictional mid-sized services business, written to show the structure. It is not template text for your policy. Your wording must reflect your own inventory, and should be reviewed by a privacy lawyer.

Decisions made by computer programs

We use computer programs, including software from third-party providers, to help us make some decisions about you.

Recruitment. When you apply for a role with us, our recruitment software uses your identity and contact details, education and employment history, answers to screening questions and, if you complete a recorded video interview, your recorded voice and image. The software automatically declines applications that do not meet mandatory requirements stated in the job advertisement (a decision made solely by a computer program). It also scores and ranks the remaining applications, which our staff use when deciding whom to invite to interview.

Customer accounts and credit. When you open a trade account, our accounts system uses your identity details, business details, payment history with us and credit information to recommend a credit limit and payment terms, which our staff then approve or change.

Fraud prevention. Our systems use identity information, device and location data and transaction history to identify unusual activity. They may automatically pause a transaction or account until we can confirm it is genuine.

If you would like more information about these decisions, or would like a decision about you to be reviewed by a person, contact our Privacy Officer using the details in section 12.

The example names real decision types, groups information in categories a reader understands, separates fully automated from assisted decisions, and flags the biometric element. It avoids generic lines such as "we may use automated tools to improve our services", which tell a reader nothing.

Checklist before 10 December 2026

• Confirm whether you are an APP entity (and record why, if you decide you’re not).
• Appoint an owner for the automated decisions inventory.
• Ask every team lead for the decisions they make about people.
• Map each decision to the software, spreadsheets and AI tools involved, including staff use of public AI tools.
• Record the kinds of personal information each program uses, and flag sensitive information.
• Classify each decision: solely automated, substantially assisted, or out of scope (with reasons).
• Request plain-English descriptions from vendors of in-scope platforms.
• Draft the new privacy policy section using your inventory, not a template.
• Have it reviewed (privacy lawyer for the wording; process owners for accuracy).
• Publish it where people can easily find it.
• Add the APP 1.7 test to procurement and to the change process for enabling new AI features.
• Set a review trigger: any new platform, new AI feature or new decision type.

Key takeaways

• The obligation starts on 10 December 2026 and covers decisions made from then on, including by software you already use.
• "Computer program" includes spreadsheets and rule-based tools, not just AI, and human sign-off doesn’t take a decision out of scope unless the oversight is real and documented.
• Your privacy policy must list the kinds of personal information used, decisions made solely by programs, and decisions programs substantially help with.
• Build an inventory of decisions first; the policy wording falls out of it.
• Write specific, grouped descriptions a reasonable person can understand, and flag sensitive information such as health or biometric data.

Sources

• Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), Schedule 1 Part 15 and commencement table, Federal Register of Legislation
• Privacy Act 1988, section 6D (small business) and section 13K (infringement and compliance notices), Federal Register of Legislation
• New resources on transparency for use of AI and automated decision-making, OAIC, 30 September 2026
• APP 1.7-1.9 Transparency Obligation Fact Sheet, OAIC, September 2026
• APP 1.7-1.9 Transparency Obligation Flowchart, OAIC
• APP Guidelines, Chapter 1: APP 1 Open and transparent management of personal information, OAIC