Skip to content

Free guide and template

Automated decisions and your privacy policy: what to change by 10 December 2026

A new Privacy Act rule starts on 10 December 2026. If software makes, or substantially helps make, decisions that could significantly affect people, your privacy policy has to say so. Here is how to tell if it applies to you, and wording you can adapt.

Or read the full text free, below.

Version 1.0 · Updated · Reflects Australian law and guidance as at 30 October 2026 · Not legal advice

In short

From 10 December 2026, APP 1.7 to 1.9 require businesses covered by the Privacy Act to describe in their privacy policy the kinds of personal information used, and the kinds of decisions made, when a computer program makes a decision, or does something substantially and directly related to making it, and the decision could reasonably be expected to significantly affect a person's rights or interests.

The rule

The Privacy and Other Legislation Amendment Act 2024 added three subclauses, APP 1.7 to 1.9, to Australian Privacy Principle 1. They start on 10 December 2026. APP 1.7 says a privacy policy must contain the information in APP 1.8 if:

(a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and

(b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and

(c) personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

APP 1.8 lists what the privacy policy must then contain: the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions where a computer program does something substantially and directly related to the decision. APP 1.9 adds that refusing or failing to decide counts, and that effects can be good or bad for the person.

The OAIC published its guidance on 30 September 2026: an updated chapter 1 of the APP Guidelines, a fact sheet with worked examples and a flowchart. It reads the rule broadly.

Does it apply to you?

Is your business covered by the Privacy Act?

The rule applies to APP entities only. Most businesses with annual turnover of $3 million or less are exempt small businesses. But a small business is covered if, for example, it provides a health service and holds health information, trades in personal information, is a contracted service provider under a Commonwealth contract (for its work under that contract), is related to a company that is not a small business, or has ever had turnover above $3 million. If you are not sure, assume you are covered.

Does a computer program make or help make the decision?

"Computer program" is broad. The OAIC says it includes rule-based processes, artificial intelligence and machine learning, everyday software and apps, and generative AI tools such as chatbots. One of its worked examples is a spreadsheet formula that ranks clients. It covers software you built, bought or configured, and AI features inside vendor software you have switched on. Using a computer only as a tool, such as typing a letter in a word processor, is not caught.

A program does something "substantially and directly related" to a decision when its output is a key factor in a person's decision and has a direct connection to it: scoring, ranking, shortlisting, flagging or recommending. The OAIC looks at how much the decision-maker relies on the output, whether they can override it, whether they can explain it, and how built into the process it is.

Could the decision significantly affect someone?

The effect has to be more than trivial, with the potential to considerably influence a person's circumstances. The OAIC points to employment, housing, credit and financial services, insurance, healthcare, essential goods and services, and access to support as typical areas. Who the person is matters too: a decision can be more significant for someone in a vulnerable position.

Is personal information used?

Almost always, if the decision is about an identifiable person.

Human review does not take you out

This is the part most businesses get wrong. A person approving a program's recommendation does not, on its own, take the decision outside the rule. The OAIC says outputs from machine learning or generative AI used in a significant decision will generally be in scope unless the decision is subject to extensive human oversight and control. In one worked example, the OAIC says a decision might fall outside the rule if staff question the output, review the data behind it, set narrower parameters, use other evidence and record why they departed from the program's recommendation. Even then, it says this only "could indicate" that the program was not substantially related to the decision. Do not treat it as a safe harbour.

When in doubt, the OAIC's advice is to include the decision in your privacy policy.

Examples

The OAIC lists decisions that will generally be in scope, including:

  • recruitment software that sorts or ranks candidates
  • AI reports used for performance rankings, promotions, bonuses or pay
  • loan and credit decisions, and insurance eligibility
  • personalised pricing of significant goods or services
  • prioritising access to health or disability services
  • eligibility for housing, education, training, scholarships and grants
  • facial recognition watchlists in shops and venues
  • programmatic advertising of significant goods or services

Decisions in smaller businesses that are easy to miss:

  • automatic payment terms or credit limits for new customers
  • automatic approval or refusal of refunds, returns or claims
  • tenant application scoring
  • triage rules that decide who gets an appointment or a call back first
  • fraud or risk rules that block orders or accounts

What to write

Add a section headed "Decisions made by computer programs" to your privacy policy. The OAIC uses this heading in its own examples: first the kinds of personal information, then the kinds of decisions. APP 1.8 asks for two kinds of decisions (those made solely by a program, and those where a program does something substantially and directly related to the decision), so our template lists them separately. Your privacy policy must be clearly expressed, and the OAIC expects plain language. You can group similar decisions as long as the result is meaningful to a reasonable person. You do not have to disclose trade secrets such as how a model is weighted, but you cannot leave something out just because it might be embarrassing.

The full template below includes the wording, a four-step test, examples by industry and a checklist.

Penalties

From 10 December 2026, leaving the required information out of your privacy policy can lead to an OAIC infringement notice of up to 60 penalty units per contravention for most companies, or 200 for listed companies. At the penalty unit value of $364 that applies from 1 July 2026, that is $21,840 or $72,800 per contravention, and one notice can cover more than one contravention. The OAIC can also issue compliance notices and seek civil penalties.

The rule is about transparency. It does not give people a new right to object to a decision. But the decision itself is still subject to anti-discrimination law, the Australian Consumer Law and, for employees, the Fair Work Act.

A plan for the weeks before 10 December

  1. This week: confirm whether the Privacy Act covers you, and list every program that touches decisions about people. The AI register template does the three-part test for you.
  2. Next week: ask your software vendors for a plain-language description of what their tools decide or recommend, and what personal information they use.
  3. By late November: draft the new privacy policy section from the template below and have it reviewed.
  4. Before 10 December: publish it, record the date, and make sure your team knows who handles questions about decisions.
  5. After: update the privacy policy whenever you add, change or retire an in-scope program.

One open question for employers: the OAIC treats AI-assisted pay and promotion decisions as in scope, but the Privacy Act's employee records exemption can apply to acts directly related to a current or former employee and their employee record. The exemption does not cover unsuccessful job applicants, contractors or outside recruitment providers. If you use software in decisions about your own staff, get advice on how the two interact.

The full template

General information, not legal advice. Have a lawyer review your final versions. Read the disclaimer

This is the complete text of the Word file. Shaded [fields] are for you to fill in.

Privacy policy wording for automated decisions

For the Privacy Act transparency rule that starts on 10 December 2026 (APP 1.7 to 1.9)

How to use this template. Work through Part A to decide whether the rule applies to you and which decisions you need to describe. Then adapt the wording in Part B and add it to your privacy policy before 10 December 2026. Delete the examples that do not apply. Replace every shaded [field].

This template is general information, not legal advice. It uses the heading and order of the OAIC's own example wording (APP 1.7 to 1.9 Transparency Obligation Fact Sheet, September 2026), and lists decisions in the two kinds that APP 1.8 requires. Have a lawyer review your final wording, especially if you make decisions about credit, insurance, employment, housing, health or government services.

Part A: Does the rule apply to you?

Step 1: Is your business covered by the Privacy Act?

The rule applies only to APP entities: Australian Government agencies and organisations that are not exempt small businesses.

Most businesses with annual turnover of more than $3 million are covered. A business with turnover of $3 million or less is generally exempt, unless, for example, it:

  • provides a health service and holds health information (clinics, allied health, pharmacies, many wellbeing businesses)
  • discloses personal information for a benefit, service or advantage, or pays to collect it (trading in personal information)
  • is a contracted service provider under a Commonwealth contract (for its work under that contract)
  • is related to a company that is not a small business
  • is a credit reporting body, or is covered for other reasons (for example, some AML/CTF reporting entities), or has opted in
  • has ever had annual turnover above $3 million since it started

If you are exempt, the rule does not apply.

Decisions about your own staff. The Privacy Act's employee records exemption can apply to acts directly related to a current or former employee and their employee record. The OAIC treats AI-assisted pay and promotion decisions as in scope, so get advice on how the two interact. The exemption does not cover unsuccessful job applicants. Many exempt businesses follow the Australian Privacy Principles anyway, because their customers and contracts expect it.

Step 2: List your computer programs that touch decisions about people

The rule covers any "computer program", not only AI. The OAIC says this includes rule-based processes, artificial intelligence and machine learning, everyday software and apps, and generative AI tools such as chatbots. One of its worked examples is a spreadsheet formula. Look at:

  • recruitment and HR software (screening, ranking, rostering, performance, pay)
  • credit, payment terms, collections and fraud tools
  • pricing engines and personalised offers
  • eligibility, onboarding and identity checks
  • triage and prioritisation of customers, patients or cases
  • chatbots and AI assistants that decide or recommend outcomes
  • vendor software with AI features you have switched on
  • spreadsheets that score or rank people

The AI register in this kit has a column that does this test for you.

Step 3: Test each one

The rule applies to a program when all three are true.

  1. It makes the decision, or does something substantially and directly related to making it. Scoring, ranking, filtering, recommending or flagging usually counts. A person reviewing the output does not, on its own, take it out of the rule. The OAIC says outputs from machine learning or generative AI used in a significant decision are generally in scope unless people exercise extensive oversight and control.
  2. The decision could reasonably be expected to significantly affect someone's rights or interests, for better or worse. Examples: a job or interview, pay or a bonus, credit or payment terms, insurance, housing, access to an essential or significant service, the price of significant goods or services. Effects that are trivial (such as the order of products on a page) usually do not count. Refusing or failing to decide also counts.
  3. Personal information about the person is used in the program's operation.

When in doubt, the OAIC's advice is to include it.

Step 4: Sort the decisions into two groups

  • Made solely by a computer program: no person is involved before the decision takes effect.
  • Substantially and directly assisted by a computer program: a person makes the final call, but the program does something substantially and directly related to it.

Part B: Wording to add to your privacy policy

Add this as a new section, after the sections about how you use personal information. Keep it in plain language. You can group similar decisions, as long as the result would make sense to a reasonable person. You do not have to disclose trade secrets, such as how a model is weighted.

Decisions made by computer programs

We use computer programs, including [rule-based software / AI tools / software from our service providers], to make, or to help us make, some decisions that could significantly affect you.

The kinds of personal information these programs use

  • [identity and contact details, such as your name, date of birth, email address and phone number]
  • [information you give us in an application or enquiry]
  • [your account, payment and transaction history with us]
  • [employment history, qualifications and other information in a job application]
  • [credit information]
  • [location information]
  • [health information] (delete if not used)
  • [biometric information, such as facial images used for identity verification] (delete if not used)

Decisions made solely by a computer program

  • [Example: approving or declining online refund requests under $[amount], based on your order history.]
  • [Example: placing new accounts on upfront payment or standard payment terms, based on payment history.]
  • [If none: We do not currently make decisions of this kind solely by computer program.]

Decisions where a computer program does something substantially and directly related to the decision

  • [Example: ranking job applications against the selection criteria, to help our team decide who to interview.]
  • [Example: flagging transactions or accounts for fraud review by our team.]
  • [Example: recommending the price or terms we offer you.]
  • [Example: prioritising requests for support or service based on the information you give us.]

Questions about these decisions

If you have a question about a decision, contact [privacy contact name or role] at [email address] or [phone]. [Optional. Include this only if you have a process to handle it: If you would like a person to reconsider a decision, contact us at the same address.] You can also ask us to correct personal information we hold about you.

Part C: Examples by industry

Use these to find decisions you might have missed. They are illustrations, not a complete list.

Industry Decisions that may be in scope
Professional services Automatic payment terms for new clients; scoring client risk for onboarding; screening job applicants
Retail and ecommerce Automatic refund and returns decisions; fraud blocks on orders; personalised pricing or offers for significant purchases; facial recognition in stores
Finance, lending and insurance Credit and loan decisions; insurance eligibility and pricing; claims triage; hardship and collections prioritisation
Health and allied health Triage and prioritising appointments or services; eligibility for programs; AI scribes whose output informs care decisions
Real estate and property Tenant application scoring and ranking
Recruitment and HR Job ad targeting, CV screening and ranking, video interview scoring, rostering and performance ratings
Education and training Admissions, scholarships, assessment and progression decisions
Utilities and telecommunications Connection, credit checks, disconnection and hardship decisions

Part D: Before 10 December 2026

  • Confirm whether the Privacy Act covers your business (Step 1).
  • List every program that touches decisions about people, including vendor software and spreadsheets (Step 2).
  • Test each one and record the result in your AI register (Step 3).
  • Ask your software vendors for a plain-language description of how their tools contribute to decisions and what personal information they use.
  • Draft the new section of your privacy policy (Part B) and have it reviewed.
  • Publish the updated privacy policy and record the date.
  • Make sure your team knows how to handle questions about decisions. If you offer a review by a person, set up who does it and how fast before you publish.
  • Set a review: update the privacy policy whenever you add, change or remove an in-scope program.

Why it matters

  • The rule applies to decisions made on or after 10 December 2026, even if the program or the information was in place before then.
  • A privacy policy that does not include the required information can lead to an OAIC infringement notice of up to 60 penalty units per contravention for most companies (200 penalty units for listed companies), or to civil penalty proceedings. At the penalty unit value of $364 that applies from 1 July 2026, that is $21,840 or $72,800 per contravention. One notice can cover more than one contravention.
  • The rule is about transparency only. It does not create a new right to object to automated decisions. Other laws, such as anti-discrimination law and the Australian Consumer Law, still apply to the decision itself.

Sources

  • Privacy Act 1988 (Cth), Schedule 1, APP 1.7 to 1.9, inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth)
  • OAIC, APP 1.7 to 1.9 Transparency Obligation Fact Sheet (September 2026) and APP Guidelines Chapter 1 (version 2.0, 30 September 2026): oaic.gov.au
  • OAIC, Small business guidance: oaic.gov.au

Australian AI Governance Kit template, version 1.0 (October 2026), by Osher Digital (osher.com.au/ai-governance-templates/).

Use this template

Download the editable Word file, or the full kit with all five templates.

Questions

Frequently asked questions

APP 1.7 is a new part of Australian Privacy Principle 1, added by the Privacy and Other Legislation Amendment Act 2024. It starts on 10 December 2026 and applies to decisions made from that date, even if the software and data were in place earlier.

Only if the Privacy Act covers your business. Most businesses with annual turnover of $3 million or less are exempt, but some are covered regardless of size, including health service providers, businesses that trade in personal information, Commonwealth contracted service providers (for their contract work) and companies related to a larger business.

It can. The OAIC says computer programs include generative AI and chatbots, and that machine learning or generative AI outputs used in a significant decision will generally be in scope unless the decision is subject to extensive human oversight and control. Using AI only to draft a letter about a decision a person has already made is not caught. But drafting can be caught: the OAIC's examples include staff using an AI chat tool to draft performance assessments that determine promotions.

Usually, yes. The rule covers programs that do something substantially and directly related to a decision, even when a person makes the final call. The OAIC says a decision may be in scope even where the program's output is subject to human review.

Three things: the kinds of personal information used by the programs, the kinds of decisions made solely by a program, and the kinds of decisions where a program does something substantially and directly related to the decision. Plain language and grouping similar decisions are fine.

Yes. The OAIC says the obligation generally stays with the business that uses the software, not the vendor. Ask your vendors for a plain-language description of what their tools do and what personal information they use.

No. You describe kinds of information and kinds of decisions, not the logic. The OAIC says trade secrets and commercially sensitive information, such as model weightings, do not need to be disclosed.

From 10 December 2026, the OAIC can issue an infringement notice for a privacy policy that leaves out the required information: up to 60 penalty units for most companies and 200 for listed companies, which is $21,840 or $72,800 per contravention at the $364 penalty unit value that applies from 1 July 2026. It can also seek civil penalties.

Both count. The rule says computer program, not AI. The OAIC's own examples include a spreadsheet formula that ranks clients and rule-based software. Automatic payment terms, refund rules and eligibility checks can all be in scope.

More from the kit

The rest of the Australian AI Governance Kit

Excel

AI register template: list every AI tool you use

Free AI register template in Excel. List each AI tool, owner, data and risk tier, and flag uses caught by the Privacy Act's automated decision rule.

Read it free

Word

AI policy template for Australian businesses

Free AI use policy template for Australian businesses, with staff rules, data limits, notetaker consent and privacy law built in. Read it, then download.

Read it free

Word

AI governance for boards: a two-page board paper and the questions to ask

A two-page AI governance board paper for Australian directors, with the questions to ask management, the decisions to make and what to report each quarter.

Read it free

Disclaimer

General information, not legal advice. These pages and templates are general information only. They are not legal advice and do not create a lawyer-client relationship. Osher Digital is an AI and automation consultancy, not a law firm.

Current as at 30 October 2026. They reflect Australian legislation and regulator guidance as at that date. Laws, guidance and vendor terms change, so check that the content is still current before you rely on it. Adapt the templates to your business, and have a qualified Australian lawyer review your final versions, especially if you work in a regulated industry or use AI or other software to make decisions about people.

Liability. To the extent permitted by law, Osher Digital is not liable for any loss or damage, including loss caused by negligence, arising from the use of or reliance on these pages or templates. Nothing in this disclaimer excludes, restricts or modifies any right or remedy you have under the Australian Consumer Law that cannot be excluded.

Sources and endorsement. The kit covers the six essential practices in the Australian Government's Guidance for AI Adoption (National AI Centre, October 2025). Links to government and other websites are for convenience; we do not control them. Osher Digital is not affiliated with or endorsed by the Australian Government, the National AI Centre or the Office of the Australian Information Commissioner.

Permitted use. You may copy, adapt and use the templates inside your own business or organisation. You may not sell them, or republish them as templates for others, without our written permission.

Want a second pair of eyes on your AI register?

Book a free 15-minute call. We look at your register, tell you which tools to fix first, and show you where AI can save your team time without adding risk.

Book a 15-minute register reviewGet in touch