Automated decisions and the Privacy Act: what changes on 10 December 2026

Who it applies to

The obligation sits on APP entities. The OAIC describes those as Australian Government agencies and organisations with an annual turnover of more than $3 million, subject to some exceptions.

Most small businesses, meaning a turnover of $3 million or less, are not covered. Some are, whatever their turnover: the OAIC's list includes health service providers, businesses that trade in personal information and contractors providing services under a Commonwealth contract. Check the list before you assume you are out.

Buying the software does not move the obligation

APP 1.7 turns on whether your organisation has "arranged for" a computer program to make or inform the decision. The OAIC's examples of arranging include buying a third-party program, configuring or customising off-the-shelf software, and relying on a program's advisory output, as well as building your own.

The OAIC expects the obligation to stay with the organisation using personal information to make the decision, not the vendor. It also says software providers should give their customers clear, high-level information about how the software can be used to make decisions, so the customer can write its privacy policy. If your vendor has not offered that, ask for it now.

What counts as a significant automated decision

Each of the three conditions is wider than the phrase "automated decision" suggests.

A computer program is almost anything

The OAIC says a computer program includes pre-programmed rule-based processes, artificial intelligence and machine learning, software, apps and word-processing tools, and generative AI, including chatbots. One of its own examples is a spreadsheet formula that ranks aged care clients by need. Staff choose whom to contact from the ranking, and the OAIC treats that as in scope.

Decisions not to act count too. The Act says making a decision includes refusing or failing to make one, so a ranking used to decide whom not to contact is caught in the same way.

"Substantially and directly related" catches advisory tools

A program does not have to make the decision. The OAIC reads "substantially" as a key factor in the person's decision, and "directly" as a direct connection with making it. A program that recommends an outcome, determines one, or in any other way influences one may meet that test.

Human review is not an automatic exit. The OAIC says a decision may be in scope even where the output is subject to human review, and that machine learning or generative AI outputs used in significant decisions would generally be in scope unless subject to extensive human oversight and control.

Its remuneration example shows where the line sits. Managers use a generative AI tool to draft each salesperson's profile and a suggested bonus and pay adjustment. HR has oversight and a director approves every outcome in writing. It is still in scope, because the recommendation is relied on to document the reasoning. The OAIC says it could fall outside if staff interrogated the outputs, reviewed the underlying measures, narrowed the tool's parameters, used further evidence, and documented why they departed from the recommendation.

"Significantly affect" is a low bar for some people

The OAIC says the impact must be more than trivial and must have the potential to considerably influence the person's circumstances or outcomes. Benefits count as well as harms: the Act says a decision can affect rights or interests adversely or beneficially. Its examples are decisions about a benefit under an Act, rights under a contract, and access to a significant service or support.

Vulnerability lowers the bar. The OAIC names children, people from a low socio-economic background, Indigenous Australians and people with a disability as cases where an effect may be significant. In its pricing example, a small per-item price difference set by postcode is significant because it compounds over time and affects access to essential goods.

Decisions the OAIC would generally treat as in scope. Swipe the table sideways to see every column.

From the OAIC's APP 1.7-1.9 fact sheet, Note 1. The list is non-exhaustive; the grouping by area is ours.

What about ChatGPT and Copilot?

The test is the decision, not the tool. Using a chat assistant to draft an email or summarise a document is not, on its own, a decision about a person. The OAIC's examples show where it does: a generative AI tool whose output is a key factor in a performance, promotion or pay decision about a named person. If your staff use general AI tools that way, those uses belong in your inventory.

What to put in your privacy policy

APP 1.8 asks for three things, described at the level of kinds rather than individual systems:

• The kinds of personal information used by the computer programs.
• The kinds of decisions made solely by a computer program.
• The kinds of decisions where a computer program does something substantially and directly related to making the decision.

The OAIC's fact sheet sets out how to write it. Make it understandable, without granular technical detail. Tailor it to your own activities. Structure it so people can ask for more information, and frame it so the decision can be reviewed. You may group decisions and types of information, but the result must be meaningful to a reasonable person. Where you use more sensitive information, such as health information or biometric templates, say so clearly.

The OAIC's worked examples put this in its own section of the privacy policy, headed "Decisions made by computer programs". Its lender example lists five kinds of information (identity information, geolocation data, biometric templates, employment record information and credit information) and three kinds of decisions (granting or denying access to accounts, the processing of a transaction, and a loan or credit application).

What you can keep confidential

Commercially sensitive information and trade secrets are excluded. In the same lender example, how its in-house fraud model weights each data point can stay out of the policy. The fact that it uses personal information to detect fraud cannot. Information that would only expose you to embarrassment or public criticism does not qualify for the exclusion.

If you are unsure, disclose

The OAIC's advice for borderline cases is direct: organisations in doubt about whether a use is in scope should take a cautious approach and include the information APP 1.8 requires.

A 30, 60 and 90-day checklist

The obligation starts on a fixed date and applies to every decision after it, so the privacy policy has to be right before 10 December 2026. The work behind it, knowing where programs shape decisions about people, takes longer. This is the order we would run it in. If you start late, compress the first 30 days; do not skip them.

First 30 days: find the decisions and update the policy

1. Name one owner. A senior person accountable for the inventory and the policy wording, with privacy, legal and the business units that make decisions about people involved.
2. List the decisions, not the systems. Start from the decisions your organisation makes about customers, applicants, staff and members: approvals, refusals, pricing, eligibility, prioritisation, ranking, hiring, pay. For each, ask which programs inform it, including spreadsheets, rules engines, vendor platforms and general AI tools.
3. Test each one against the three conditions. Is a program a key factor with a direct connection to the outcome? Could the outcome significantly affect someone, particularly someone vulnerable? Does it use their personal information? Record the reasoning either way.
4. Ask your vendors. Request the high-level description the OAIC says providers should give: what the software decides or recommends, and what personal information it uses.
5. Draft, review and publish the new section of your privacy policy, with legal review, before 10 December 2026. Where a use is borderline, include it.

Days 31 to 60: make the disclosure true in practice

1. Brief the people who answer questions. Customer service, HR and complaints teams will be asked what the new section means. Give them a short script and an escalation path.
2. Check your human review. Where you rely on people to oversee a program's output, confirm they interrogate it, use other evidence and record why they depart from it. If they rubber-stamp it, the decision is in scope and the oversight is weaker than you think.
3. Set up a way to challenge a decision. The National AI Centre's guidance calls these contestability channels. The privacy policy tells people a program was involved; they will want somewhere to take it.
4. Add a gate to procurement and change. Any new tool, or new use of an existing one, that could inform a decision about a person goes through the same three-condition test before it goes live.

Days 61 to 90: make it part of governance

1. Turn the inventory into an AI register with an owner for each system, kept up to date as a standing record rather than a one-off project.
2. Report to the board or executive. Which decisions are in scope, what the policy now says, where oversight is thin, and what changes next.
3. Set a review date for the privacy policy section and the register, and re-read the OAIC's guidance at each review.
4. Fold it into your AI policy. Our one-page AI policy template already says AI never makes a decision about a person on its own, and that any use shaping a decision about a person needs approval. Make sure your own policy says the same.

How it fits with the Guidance for AI Adoption

The Privacy Act sets what your privacy policy must disclose. The National AI Centre's Guidance for AI Adoption, published on 21 October 2025, describes how to govern AI use more broadly, in six essential practices: decide who is accountable, understand impacts and plan accordingly, measure and manage risks, share essential information, test and monitor, and maintain human control. Most of the work APP 1.7 needs is already in those practices.

• Decide who is accountable. The guidance starts with a senior leader as the overall AI governance owner, and a named person for each AI system. That is the owner your APP 1.7 work needs.
• Share essential information. The guidance says to keep an AI register that covers AI embedded in other systems, such as HR and customer engagement tools, and to disclose AI use especially where AI makes or influences decisions. The register is your APP 1.7 inventory.
• Understand impacts. It asks for channels for people to report problems with, challenge or question AI decisions, and attention to vulnerable cohorts, which is the same group the OAIC says lowers the significance bar.
• Maintain human control. It calls for mandatory human review of high-stakes decisions. The OAIC's remuneration example shows that review must be real to change how a decision is treated.

If you are building a fuller AI governance framework, our ISO/IEC 42001 guide for Australian organisations explains what the international standard for an AI management system asks for, and when certification is worth it.

Where to get help

The hard part of APP 1.7 is not the paragraph in the privacy policy. It is finding every place a program shapes a decision about a person, and deciding honestly whether a human really makes the call.

Our AI governance work gives your organisation one rule people can follow, written against the Privacy Act and your industry's own obligations, and a position your board can put its name to. It sits alongside your legal advice, not in place of it.

The people who review AI output need to know what real oversight looks like in practice. Our AI training for teams includes a governance module practised on each person's own documents, and 96% of participants said they were likely to apply what they learned (Post-training survey, n=220, October 2025 to September 2026).

Not sure where you stand? The free AI readiness assessment is seven questions and takes about three minutes.

Frequently asked questions

Sources

Every legal statement on this page comes from the Act, the OAIC or the National AI Centre. We read each source on 23 October 2026. The obligation is new and the guidance may change, so check the source before you rely on it.

1. Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024), as made (commencement table item 7; Schedule 1, items 56, 57 and 87 to 89). Read 23 October 2026.
2. Office of the Australian Information Commissioner, APP 1.7-1.9 Transparency Obligation Fact Sheet (September 2026). Read 23 October 2026.
3. Office of the Australian Information Commissioner, Chapter 1: APP 1 Open and transparent management of personal information (version 2.0, updated 30 September 2026). Read 23 October 2026.
4. Office of the Australian Information Commissioner, New resources on transparency for use of AI and automated decision-making (30 September 2026). Read 23 October 2026.
5. Office of the Australian Information Commissioner, Infringement notices (published 22 September 2026). Read 23 October 2026.
6. Office of the Australian Information Commissioner, Small business. Read 23 October 2026.
7. Office of the Australian Information Commissioner, Rights and responsibilities. Read 23 October 2026.
8. National AI Centre, Guidance for AI adoption: foundations (and its PDF, published 5 May 2026). Read 23 October 2026.
9. Department of Industry, Science and Resources (National AI Centre), Voluntary AI Safety Standard (updated 2 December 2025) (for the Guidance for AI Adoption's publication date). Read 23 October 2026.

Related guides

• A one-page AI policy template for Australian organisations

  Copy a one-page AI policy for Australian organisations: approved tools, what data may go in, who checks output, who owns AI risk, and how to roll it out.

• ISO/IEC 42001 for Australian organisations: what it asks and whether to certify

  ISO/IEC 42001 is voluntary in Australia. What the AI management system standard asks of an organisation, and when certification is worth the audit.

• AI for financial services in Australia: the uses and the rules

  AI in Australian financial services: where banks, insurers, advisers and brokers use it, what APRA, ASIC and the Privacy Act expect, and the controls.

Related services

• AI strategy consulting and governance: One rule your people can follow, written against the Privacy Act and your industry's obligations.
• AI training for teams: Hands-on sessions on the tools your team already licenses, run on your own documents.
• Free AI readiness assessment: Seven questions, about three minutes.

All AIRE guides