Privacy Act, from 10 December 2026
Automated Decision-Making Under the Privacy Act: What Changes on 10 December 2026
From 10 December 2026, a business covered by the Privacy Act that uses a computer program to make, or substantially help make, decisions that could significantly affect people must say so in its privacy policy. It is a disclosure obligation, not a right to an explanation. And it is not only about AI: the OAIC’s guidance includes a rules-based spreadsheet formula. Check first whether the Privacy Act applies to you.
General information only. This page is not legal advice.
When does APP 1.7 apply?
The new principle was added by the Privacy and Other Legislation Amendment Act 2024 and starts on 10 December 2026. It applies when all three of these are true.
1. You arranged for a program
You built, bought, configured or rely on a computer program that makes a decision, or does something substantially and directly related to making one. Buying it from a vendor does not move the obligation to the vendor.
2. The decision is significant
It could reasonably be expected to significantly affect someone’s rights or interests, for better or worse. Refusing or failing to decide counts as a decision.
3. Personal information is used
Personal information about the person is used when the program runs. A program that never touches personal information is outside the principle.
The Act gives three examples of decisions that may affect someone’s rights or interests: granting or refusing a benefit under a law, decisions affecting their rights under a contract, and decisions affecting their access to a significant service or support. It applies to decisions made from 10 December 2026, even if the system was set up, and the information collected, before then.
Sources: Privacy and Other Legislation Amendment Act 2024 (Cth), Sch 1 Pt 15, items 87 to 89 · OAIC, APP 1.7 to 1.9 Transparency Obligation Fact Sheet (September 2026)
This is not only about AI
The OAIC’s guidance, published in September 2026, reads “computer program” broadly. It includes pre-programmed rules, machine learning, ordinary software and apps, and generative AI, chatbots included. Two points in that guidance catch people out.
A spreadsheet can be enough
One of the OAIC’s own examples is a health and aged care provider whose spreadsheet formula scores clients and ranks who should be contacted for support. Staff make the calls, but the formula decides the order, so it is in scope. It would still be in scope if the ranking were used to decide who not to contact.
A human sign-off may not take it out
A program’s output can be in scope even when it is only advice and a person makes the final decision. The OAIC says machine learning or generative AI outputs used in significant decisions will generally be in scope unless there is extensive human oversight and control: people interrogating the output, weighing other evidence, and recording why they departed from it.
Using a tool only to draft, summarise or document a decision a person has already made is a different thing. The question is whether the program was a key factor in reaching the decision. If you are genuinely unsure, the OAIC suggests taking a cautious approach and including the information.
Which decisions are likely to be caught?
The OAIC lists decisions it would generally treat as in scope. The ones most relevant to private businesses include:
Hiring
Recruitment software that sorts candidates, screens video interviews or produces a shortlist.
Credit and insurance
Programs that approve or reject a loan or credit application, or assess eligibility for insurance.
Health and care
Tools that prioritise who receives health or disability services, or admission to an education or training program.
Staff and pricing
AI reports used to rank performance or set bonuses, and personalised pricing of significant goods or services.
What your privacy policy has to say
APP 1.8 asks for three things, described at the level of kinds rather than system detail.
What it requires
- The kinds of personal information used by those programs
- The kinds of decisions made solely by a program
- The kinds of decisions where a program does something substantially and directly related to the decision
- Enough detail to be meaningful to a reasonable person, with sensitive information such as health or biometric data made clear
What APP 1.7 does not require
- Explaining how a model or algorithm works
- Telling a person that a particular decision about them was automated
- Offering human review of an individual decision
- Disclosing trade secrets or genuinely commercial-in-confidence detail
If a vendor supplies the program, the disclosure is still yours. The OAIC expects vendors to give their customers clear, high-level information about how their software makes decisions, so ask for it in writing. For the wider question of how AI use should appear in a privacy policy, see does your privacy policy need to mention AI.
What happens if the policy is missing this information?
From 10 December 2026, APP 1.7 joins the short list of privacy policy breaches the OAIC can deal with by compliance notice or infringement notice, without going to court. A compliance notice can require the business to fix its policy within a reasonable period and to produce reasonable evidence that it has. Failing to comply is a further contravention. More on what the OAIC checks and the powers it has.
What to do before 10 December, and what to keep on record
Most of the work is finding out where programs already shape decisions about people. They are often inside tools bought for another purpose.
1. Find the programs
- Recruitment, lending, pricing, eligibility, triage and HR tools
- Rules and scoring inside CRMs and spreadsheets
- AI tools staff use to assess people, not just to write
2. Assess each one
- What decision it feeds, and how significant it is
- What personal information it uses
- Whether it decides alone or informs a person, and what that person actually does
3. Update and record
- The privacy policy, with the date it changed
- Each in-or-out call, with reasons and who made it
- An owner who reviews it when a new tool arrives
Cleverer’s Policy Builder includes an automated decision-making section in the privacy and data handling policy it generates, written to the APP 1.8 items, and leaves it out for a business that has recorded it is outside the Privacy Act. The systems behind it can be recorded in the vendor and asset registers, each with an owner and a review date. The assessment of which decisions are caught is still yours to make. For a broader approach to tracking AI use, see AI governance for small and medium businesses.
Know which of your decisions are caught, and show your working.
A dated record of the programs you assessed, the call you made on each and the policy wording that followed is what answers the OAIC if it asks.
Common questions about automated decisions and the Privacy Act
When do the automated decision-making rules start?
On 10 December 2026. They apply to decisions made from that date, even where the program was set up and the personal information collected before it.
Does APP 1.7 apply to small businesses?
Only to those covered by the Privacy Act. A small business operator with turnover of $3 million or less is generally exempt, but a business that provides a health service, trades in personal information or falls within another exception is covered and has the same obligation as a large company.
If a person makes the final decision, are we outside the rule?
Not necessarily. APP 1.7 covers programs that do something substantially and directly related to a decision, not only programs that decide alone. The OAIC says a program’s output can be in scope even when a person reviews it, unless that oversight is extensive and genuine.
Do we have to tell someone that a decision about them was automated?
Not under APP 1.7. It is a disclosure in your privacy policy about the kinds of decisions and information involved. It does not require individual notices, explanations of particular outcomes or a right to human review.
Does using ChatGPT or Copilot trigger it?
Only if the tool is used to make, or substantially help make, a decision that could significantly affect someone, using their personal information. Drafting an email does not. Asking it to rank job applicants or recommend a staff member’s bonus can.
