Privacy Act reform
Automated decision-making and your privacy policy: a 10 December 2026 readiness guide
From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when computer programs make, or substantially and directly help make, decisions that significantly affect people. Here is what changes, what is in scope and how to be ready.
At a glance
10 Dec 2026
New APP 1.7 to 1.9 transparency obligation starts
30 Sep 2026
OAIC guidance, fact sheets and flowchart published
3 tests
Arrangement, significance and personal information
What changes on 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 added new paragraphs to Australian Privacy Principle 1. Once they start, your privacy policy must describe how you use computer programs in decisions that could significantly affect individuals.
The obligation applies when all three of these are true:
- Arrangement: you have arranged for a computer program to make a decision, or to do something substantially and directly related to making it. That includes software you build, buy, configure or simply rely on.
- Significance: the decision could reasonably be expected to significantly affect an individual’s rights or interests.
- Personal information: the program uses personal information about the individual to do its work.
Where they are, the privacy policy must describe:
- the kinds of personal information used in the operation of those programs
- the kinds of decisions made solely by a computer program, and
- the kinds of decisions where a computer program does something substantially and directly related to the decision.
It is not just about AI
The OAIC’s guidance makes clear the obligation covers far more than machine learning or generative AI. Rule-based eligibility calculators, scoring formulas in spreadsheets, configured SaaS workflows, pricing engines and fraud detection rules can all be in scope.
A person signing off the final decision does not automatically take a tool out of scope. If the program’s output materially shapes the outcome, plan on disclosing it.
Is your system in scope? Common examples
These are the kinds of uses the OAIC and Australian commentators have flagged. If any of them sound familiar, include them in your assessment.
Four misconceptions to clear up early
“We don’t use AI, so this doesn’t apply.”
The test is about computer programs, not AI. Spreadsheets with scoring logic, rules engines and configured off-the-shelf systems can all meet it.
“A person always makes the final call.”
Human review helps, but the OAIC treats programs whose outputs substantially and directly inform a decision as in scope unless people genuinely interrogate the output and can depart from it.
“Our vendor is responsible.”
The obligation sits with you as the organisation using the tool. Vendors are expected to give you enough information to describe their software, so ask for it in procurement and contracts.
“We can describe it in one generic sentence.”
Grouping is allowed, but the groupings must be meaningful to the people affected. Sensitive information such as health details or biometric templates needs particular clarity.
A practical readiness plan
Most organisations can work through this in a few focused weeks if the right people are in the room. The steps below follow the OAIC guidance and what we see work in practice.
Find every decision system
Ask each business area (customer, operations, finance, HR, marketing and technology) where software scores, ranks, flags, prices or decides. Include third-party platforms and anything configured in-house.
Test each one against the three conditions
Record whether the program makes or substantially and directly informs the decision, how significant the decision is for the people affected, and what personal information it uses.
Document your reasoning
Keep a short assessment for each system, including the ones you decide are out of scope. It is your evidence if the OAIC, an auditor or a client asks.
Update the privacy policy
Describe the kinds of personal information and decisions in plain language. If in doubt, include it. Check your APP 5 collection notices say the same thing.
Build it into PIAs and AI governance
Add the three tests to your privacy impact assessment template, AI risk assessment and procurement checklist so new tools are assessed before they go live.
Brief the people who buy and configure tools
Procurement, IT and business owners need to know a new rule or vendor feature can change your privacy policy obligations.
How Transform LogiQ helps
We run ADM readiness as a short, fixed-scope engagement led by senior consultants who hold the IAPP Artificial Intelligence Governance Professional (AIGP) credential. You get decisions and wording you can use, not a long report.
- an inventory of the computer programs used in decisions about people
- a documented three-test assessment for each one
- draft privacy policy wording and aligned collection notices
- updates to your PIA and AI risk templates so the check sticks
- a short briefing for executives and the board
Related services
Frequently asked questions
When does the automated decision-making obligation start?
On 10 December 2026. From that date your privacy policy needs to include the APP 1.8 information for any computer programs that meet the three tests.
Who does it apply to?
APP entities: Australian Government agencies and organisations covered by the Privacy Act. Most businesses with an annual turnover of $3 million or less are not APP entities, but some are, for example health service providers and businesses that trade in personal information.
Do we have to explain how our algorithm works?
No. You describe the kinds of personal information used and the kinds of decisions involved. Commercially sensitive details such as model weightings do not need to be disclosed, although the fact that personal information is used still does.
Do we need to notify individuals directly?
The new paragraphs are a privacy policy transparency requirement. They do not create a new right to contest decisions. It is still good practice to make your collection notices consistent with the updated policy.
What if our privacy policy is wrong or incomplete?
Following the 2024 reforms, the OAIC can issue infringement notices for some privacy policy failures. An inaccurate policy also weakens your position under other APPs if there is a complaint, breach or investigation.
How does this relate to the rest of the Privacy Act reforms?
It is one of the first-tranche changes that is already law. Treat it as a reason to build a lasting register of decision systems, because later reforms and AI-specific expectations are likely to draw on the same information.
Sources: OAIC, New resources on transparency for use of AI and automated decision-making (30 September 2026); Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1. This page is general information, not legal advice.
Start with a 45-minute governance health check
A conversation, not a proposal. We will tell you where your real exposure sits and what to fix first, whether or not you engage us.