Australia’s Automated Decision-Making Privacy Policy 2026
From 10 December 2026, Australian Privacy Principle (APP) entities must explain certain uses of computer programs in their privacy policies when personal information is used for decisions that could significantly affect people’s rights or interests. With the commencement date 47 days away, businesses should map their automated decision workflows now, check whether the rule applies, and update their privacy policy with clear, specific information.
The Office of the Australian Information Commissioner (OAIC) published updated guidance and practical resources on 30 September 2026. This is an enacted privacy-law change with a future commencement date, not a proposal. It does not mean every use of AI, analytics or automation must be listed. The test depends on the program, the personal information it uses and the likely effect of the decision.
This guide summarises the change for Australian and Tasmanian organisations, including small businesses that need to check whether the Privacy Act covers them. It is general information, not legal advice.
What changes on 10 December 2026?
Part 15 of the Privacy and Other Legislation Amendment Act 2024 adds APP 1.7–1.9 to the Australian Privacy Principles. From 10 December, an APP entity must include specified information in its APP privacy policy when it has arranged for a computer program to make a decision—or perform an action substantially and directly related to a decision—that could reasonably be expected to significantly affect an individual’s rights or interests, and personal information about that individual is used by the program.
The OAIC’s 30 September 2026 announcement explains the obligation and links to its fact sheet, flowchart and updated APP 1 Guidelines. These are the best starting points for checking the rule against your actual systems.
Who needs to prepare?
The obligation applies to APP entities, including Australian Government agencies and many private-sector and not-for-profit organisations covered by the Privacy Act 1988. Do not assume that a business is covered—or exempt—based only on its size or whether it calls itself an AI business.
The OAIC says most small businesses with annual turnover of $3 million or less are generally not covered by the Privacy Act, but exceptions apply. These can include health service providers, businesses that trade in personal information, certain Commonwealth contractors and operators of residential tenancy databases. Other sector-specific rules may also matter. Use the OAIC’s small business privacy guidance to check your position, and obtain advice if the answer is unclear.
If the Privacy Act does not currently apply to your business, the new APP obligation may not apply to you as an APP entity. However, transparent handling of customer and staff information remains sound practice, and your position can change as your business grows or activities change.
The three-part test for automated decisions
Review each workflow against all three parts of the legal test. A system does not fall within the obligation merely because it uses a computer program or produces a recommendation.
1. Has your organisation arranged for the program to make or support a decision?
“Computer program” is interpreted broadly. It can include rule-based software, AI and machine-learning tools, third-party platforms, and generative AI. The program may make the final decision or produce an output that substantially and directly influences a human decision-maker. Meaningful human review does not automatically take a workflow outside the rule.
The OAIC’s updated guidance gives examples such as AI screening job applicants, AI-generated performance assessments used for promotion decisions, software that automatically approves or declines refunds, and systems that automatically escalate complaints. If you procure a tool or direct staff to use it for a consequential decision, outsourcing the technology does not necessarily shift the privacy-policy responsibility to the vendor.
2. Could the decision significantly affect someone’s rights or interests?
The effect must be more than trivial and could be beneficial or adverse. Examples may include access to employment, housing, healthcare, essential services, credit or financial assistance, or decisions affecting contractual rights. The context matters: the same account action may affect one person more seriously than another.
Personalised pricing or targeted content may also be relevant where it meaningfully changes access to important goods, services or opportunities. By contrast, routine website analytics, spellchecking or ordinary administrative automation will not automatically meet this test simply because software is involved.
3. Is personal information used by the program?
Identify the information the system receives, infers or relies on about an individual. Depending on the workflow, this might include application details, purchase history, account activity, location, customer ratings, employment records or information entered into an AI tool. Do not assume a vendor’s description of its product is a complete data map.
Where all three conditions are met, assess the policy disclosure required under APP 1.8. If a condition appears not to be met, record why and revisit the assessment when the system or its use changes.
What must the privacy policy explain?
Where the obligation applies, the APP privacy policy must describe:
- The kinds of personal information used by the relevant computer programs.
- The kinds of decisions made solely by those programs that may significantly affect individuals’ rights or interests.
- The kinds of decisions for which the program performs an action substantially and directly related to making the decision, such as generating a recommendation that materially influences a human decision.
Write for a customer, applicant or worker—not a software engineer. The OAIC recommends meaningful, accessible information that is specific enough to be useful without overwhelming readers. Similar workflows can be grouped where the description remains clear. Sensitive information, such as health or biometric information, may need to be identified distinctly where it is used.
The rule does not require organisations to publish source code or disclose information that genuinely qualifies as commercial-in-confidence or would expose trade secrets. That is a limited exclusion, not a reason to hide the fact that consequential automated decision-making is used.
Examples for Australian and Tasmanian businesses
| Workflow | Questions to check | Possible policy detail if in scope |
|---|---|---|
| AI screening of job applications | Does the system rank or filter applicants using personal information? How much does the ranking influence hiring? | Types of application information used and the categories of hiring decisions the tool makes or supports. |
| Automated refund decisions | Can the software approve or decline a refund? Does the decision materially affect a customer? | Types of transaction or account information used and the categories of refund decisions automated or supported. |
| Account suspension or fraud flags | Can a program restrict access to an account or service? Is personal information used to make that call? | Relevant information types and categories of account-access decisions, described at a meaningful level. |
| AI-assisted performance assessments | Does an AI output materially inform a promotion or other employment decision? | Types of worker information used and categories of employment decisions supported. |
| Routine website analytics | Is the system only reporting aggregate traffic, or does it use personal information to make a significant decision about a person? | Do not assume the new obligation applies; document the assessment and check other privacy duties separately. |
For a Hobart retailer, an automated refund rule may be more relevant than a basic sales dashboard. A recruitment firm may need to review screening and ranking tools, while a service provider may need to examine eligibility or account-access workflows. The product label is less important than what the program actually does and how its output is used.
A practical preparation checklist
1. Build an inventory of decision systems
Ask operations, HR, finance, customer service, marketing and IT to list software that approves, rejects, ranks, flags, recommends, suspends, prioritises or escalates individual cases. Include features inside platforms already in use, not just separately purchased AI products.
2. Map data and outcomes
For each workflow, record the personal information used, the program’s output, the decision it affects, the people affected and whether a human reviews the result. Note whether the decision can affect employment, finances, access to services, contractual rights or another significant interest.
3. Check the supplier and contract
Ask vendors to explain how the feature works in practice, which data it uses, what outputs it produces, and how those outputs influence decisions. Confirm whether the supplier changes the model or feature over time, whether staff can override a result, and who will tell you when the workflow changes. Contracts should support your ability to understand and describe the system.
DanSol’s guide to custom software versus off-the-shelf systems covers related questions about vendor dependency, data control and ownership when selecting business software.
4. Draft policy wording from verified facts
Do not copy a generic “we may use AI” paragraph and assume it meets APP 1.8. Describe the kinds of information and decisions actually used by your organisation. If different systems have materially different roles, make those distinctions understandable. Keep a record of the internal assessment supporting the wording.
5. Review the whole privacy notice
Make sure the policy remains consistent with your collection notices, actual data practices, retention rules and processes for access, correction, questions and complaints. The new disclosure is one part of an APP privacy policy, not a replacement for the other privacy principles or a general authorisation to collect and use personal information.
6. Assign an owner and a review date
Give someone responsibility for coordinating the inventory, obtaining vendor answers, approving policy changes and checking the live website. Review the assessment when you add a new tool, change a workflow or begin using personal information in a new way. Keep the public policy easy to find and available without charge.
7. Check the live website before 10 December
Publish the approved wording, check it on mobile and desktop, confirm the policy link works, and ensure the displayed version is the one reviewed by the responsible person. If a developer or agency maintains your website, give them the final approved copy and a clear deadline. DanSol’s Hobart web design service can help with website implementation, but the business remains responsible for confirming the policy accurately describes its data practices.
How this relates to wider AI governance
The privacy-policy obligation is not a certification scheme for AI, and it does not settle every question about fairness, accuracy, security or lawful data use. Organisations should separately assess whether personal information is collected and used appropriately, whether the system is reliable, and whether people have a practical way to question an outcome.
For a broader approach to selecting and governing AI tools, see DanSol’s Business Tasmania AI guide for Hobart businesses. Where automated tools are used to monitor employees or inform employment decisions, DanSol’s separate guide to AI workplace surveillance in Tasmania covers that distinct workplace context.
Frequently asked questions
Does the rule start on 10 December 2026?
Yes. The relevant provisions in the Privacy and Other Legislation Amendment Act 2024 are scheduled to commence on 10 December 2026. The OAIC published updated APP 1 guidance and resources on 30 September 2026.
Does every business using AI have to change its privacy policy?
No. The obligation applies to APP entities and only where the legal conditions are met: a computer program makes or substantially and directly supports a decision that could significantly affect an individual’s rights or interests, and personal information about that individual is used. Check your coverage and each workflow rather than relying on a broad label.
Are small businesses automatically exempt?
No blanket assumption is safe. Most businesses with annual turnover of $3 million or less are generally exempt from the Privacy Act, but exceptions apply, including to some health providers and businesses that trade in personal information. Check the OAIC’s current small-business guidance.
Do we need to publish our algorithm or source code?
No. The obligation concerns meaningful information about the kinds of personal information and decisions involved. Commercial-in-confidence information and trade secrets are excluded in limited circumstances, but organisations should not use that exclusion to avoid clear disclosure of covered practices.
Does human review mean the rule does not apply?
Not necessarily. If a program’s recommendation or action is substantially and directly related to making the decision, and the other conditions are met, the obligation may still apply even when a person makes the final call.
What should we do first?
List the systems that make or influence decisions about individuals, map the personal information they use, assess the significance of the outcomes and check whether your organisation is an APP entity. Then use the OAIC’s updated guidance to prepare accurate policy wording.
Official sources
- OAIC: New resources on transparency for AI and automated decision-making (30 September 2026)
- OAIC: APP 1 Guidelines, updated 30 September 2026
- OAIC: Small business and the Privacy Act
- Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024
Information checked on 24 October 2026 against the OAIC’s updated guidance and the enacted legislation. This article is general information only and is not legal advice. Organisations should assess their own coverage and circumstances.