Notifiable Data Breaches scheme<\/a> walks through those coverage rules in more detail.<\/p>\n\n\n\nIf you’re unsure, the OAIC’s fact sheet says entities in doubt "should take a cautious approach" and include the information.<\/p>\n\n\n\n
How does the OAIC read the three tests?<\/h2>\n\n\n\n On 30 September 2026 the OAIC released an APP 1.7-1.9 fact sheet, a flowchart, a supplementary fact sheet for agencies, and updated APP 1 guidelines. These points from the fact sheet change the most for small and mid-sized organisations.<\/p>\n\n\n\n
"Computer program" covers more than AI<\/h3>\n\n\n\n The fact sheet lists pre-programmed rule-based processes, artificial intelligence and machine learning, "software, apps or word-processing tools", and generative AI, including chatbots. Its first worked example is a health and aged care provider whose spreadsheet formula<\/strong> scores and ranks clients for follow-up. The OAIC treats that spreadsheet as in scope, and says it would still be in scope if staff used the ranking to decide whom not<\/em> to contact.<\/p>\n\n\n\nYou have "arranged for" a program if you built it, bought it, configured off-the-shelf software, authorised it to decide, or rely on its advice. Buying a SaaS product doesn’t move the obligation to the vendor. The OAIC generally expects the obligation to stay with the organisation making the decision, and says software providers should give clear, high-level information about how their products can be used to make decisions, so customers can write their policies.<\/p>\n\n\n\n
"Substantially and directly" includes advice a human follows<\/h3>\n\n\n\n "Substantially" means the program is a key factor in the human’s decision. "Directly" means it has a direct connection with making the decision. A program can meet the test if it advises an outcome, determines it, or "in any other way influences" it.<\/p>\n\n\n\n
The fact sheet says a decision may be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review". It also says machine learning or generative AI outputs used to make significant decisions "would generally fall within scope… unless subject to extensive human oversight and control".<\/p>\n\n\n\n
Its example is a sales team whose managers use a generative AI tool to suggest bonuses. Director sign-off on every decision did not take it out of scope, because the AI’s recommendation was a key factor. What might change the answer: staff interrogating outputs, reviewing the underlying indicators, narrowing the tool’s parameters, using additional evidence, and documenting why they departed from its recommendation.<\/p>\n\n\n\n
"Significantly affect" means more than trivial<\/h3>\n\n\n\n The impact must be more than trivial and have the potential to considerably influence a person’s circumstances. Vulnerability counts: a decision can be significant for someone experiencing vulnerability even if it wouldn’t be for most people. The OAIC’s pricing example finds that small personalised price differences on essential goods are significant because they compound over time.<\/p>\n\n\n\n
Which decisions are likely to be in scope?<\/h2>\n\n\n\n The OAIC’s non-exhaustive list of decisions that would generally be in scope includes:<\/p>\n\n\n\n
\n\nrecruitment software that sorts candidate profiles and informs hiring;<\/li>\n\n\n AI-generated reports used to rank employee performance, decide promotions or set bonuses;<\/li>\n\n\n approving or rejecting a loan or credit application;<\/li>\n\n\n assessing eligibility for insurance;<\/li>\n\n\n prioritising health or disability services;<\/li>\n\n\n eligibility for housing assistance, government benefits, education or training programs, scholarships or grants;<\/li>\n\n\n facial recognition for watchlist matching in a store or stadium;<\/li>\n\n\n personalised pricing and programmatic advertising for significant goods or services.<\/li>\n\n<\/ul>\n\n\n\nFor a typical organisation with 20 to 500 staff, the places to look are less obvious. A common example is a recruitment platform that auto-rejects applicants who answer a knockout question "wrong", or scores video interviews. Others include an accounts system that sets credit limits or payment terms automatically, a fraud or identity rule that locks a customer’s account, a tenancy or membership platform that screens applicants, a rostering tool that allocates shifts (and therefore income) to casual staff, and a client triage spreadsheet in a health, disability or community service.<\/p>\n\n\n\n
Less likely to meet the "significantly affect" test on their own: a spam filter, spell check, meeting scheduling, or a chatbot that answers general questions. Test each one anyway; a chatbot that decides who gets a callback, or a filter that silently drops job applications, is different.<\/p>\n\n\n\n
How to find automated decisions in your organisation<\/h2>\n\n\n\n Step 1: List the decisions, not the software.<\/strong> Ask each team lead what decisions you make about customers, clients, applicants, members, staff or volunteers: approve, reject, prioritise, price, rank, refer, suspend, enrol, pay.<\/p>\n\n\n\nCheck:<\/strong> you have decisions from HR and recruitment, finance and credit, customer service, and any client-facing service teams, not just IT.<\/p>\n\n\n\nStep 2: For each decision, ask what software touches it.<\/strong> Include SaaS platforms, spreadsheets with formulas, automation rules, scoring features turned on by default, and anything using AI, including staff using public AI tools to summarise or rank people.<\/p>\n\n\n\nCheck:<\/strong> you have asked "does anyone paste applicant, client or staff details into an AI tool to help decide?" Unapproved AI use is common and won’t show up in your software register.<\/p>\n\n\n\nStep 3: Record what personal information each program uses.<\/strong> Use categories (identity, contact, financial, employment, health, biometric, location, behavioural). Flag sensitive information clearly; the OAIC says it should be clear in the policy where more sensitive types such as health information or biometric templates are used.<\/p>\n\n\n\nStep 4: Classify each decision.<\/strong> Is it made solely by the program, or does the program do something substantially and directly related to a human’s decision? Or is the program’s role minor, with extensive human oversight you can show?<\/p>\n\n\n\nCheck:<\/strong> if you’re relying on "a human reviews it", you can point to written evidence that staff interrogate the output and document departures, not just a sign-off.<\/p>\n\n\n\nStep 5: Ask vendors.<\/strong> For each platform in scope, ask the vendor for a plain-English description of how its features use personal information to make or inform decisions. The OAIC says software providers should give their customers clear, high-level information of this kind.<\/p>\n\n\n\nStep 6: Decide and record.<\/strong> Record your conclusion and reasoning for each row, including those you decide are out of scope.<\/p>\n\n\n\nInventory template<\/h3>\n\n\n\n Copy this into a spreadsheet. One row per decision.<\/p>\n\n\n\n\n\n\nColumn<\/th>\n What to record<\/th>\n Example entry (illustrative only)<\/th>\n<\/tr>\n<\/thead>\n \n\nDecision<\/td>\n The decision made about a person<\/td>\n Shortlist graduate applicants for interview<\/td>\n<\/tr>\n \nTeam and owner<\/td>\n Who is accountable<\/td>\n People and culture, HR manager<\/td>\n<\/tr>\n \nPeople affected<\/td>\n Customers, applicants, staff, members, clients<\/td>\n Job applicants<\/td>\n<\/tr>\n \nProgram or platform<\/td>\n System, feature, spreadsheet or AI tool<\/td>\n Recruitment platform’s screening and ranking feature<\/td>\n<\/tr>\n \nArranged how<\/td>\n Built, bought, configured, relied on<\/td>\n Bought (SaaS), scoring rules configured in-house<\/td>\n<\/tr>\n \nPersonal information used<\/td>\n Categories; flag sensitive ones<\/td>\n Identity, contact, education, work history, video interview recordings (biometric<\/strong>)<\/td>\n<\/tr>\n\nProgram’s role<\/td>\n Solely decides \/ substantially and directly related \/ minor<\/td>\n Ranks applicants; HR invites the top-ranked<\/td>\n<\/tr>\n \nHuman oversight<\/td>\n What staff actually do, and the evidence<\/td>\n HR reads top 20 profiles; no record of departures<\/td>\n<\/tr>\n \nSignificant effect?<\/td>\n Rights or interests affected, vulnerability<\/td>\n Access to employment<\/td>\n<\/tr>\n \nIn scope of APP 1.7?<\/td>\n Yes \/ no \/ unsure (treat unsure as yes)<\/td>\n Yes<\/td>\n<\/tr>\n \nPolicy wording reference<\/td>\n Where it appears in the policy<\/td>\n Section 9, "Recruitment"<\/td>\n<\/tr>\n \nReview date<\/td>\n When the row is next checked<\/td>\n Next platform change or annual review<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\nWhat should the privacy policy say?<\/h2>\n\n\n\n The OAIC asks for information that is meaningful to a reasonable person without unnecessary technical detail. You can group decisions and information types, but should tailor the wording to your activities and let people ask for more. Trade secrets and commercially sensitive information are excluded; the fact that you use a program for significant decisions is not.<\/p>\n\n\n\n
A simple structure that maps to APP 1.8:<\/p>\n\n\n\n
\n\nA heading people can find, such as "Decisions made by computer programs".<\/li>\n\n\n For each group of decisions: the kinds of personal information used.<\/li>\n\n\n The kinds of decisions made solely by computer programs.<\/li>\n\n\n The kinds of decisions where computer programs substantially and directly help a person decide.<\/li>\n\n\n How to ask questions or seek a review (this isn’t one of the three APP 1.8 items, but the OAIC encourages framing the information so the decision can be reviewed).<\/li>\n\n<\/ol>\n\n\n\n