Privacy Act Automated Decisions: What Your Privacy Policy Must Say by 10 December 2026

From 10 December 2026, organisations covered by Australia’s Privacy Act must explain in their privacy policy when they use computer programs to make decisions about people, or to do things substantially related to making those decisions. The OAIC released its final guidance on 30 September 2026, which leaves about ten weeks to get ready.

This is not just about AI. The guidance makes clear that “computer program” is broad: rules engines, scoring spreadsheets, chatbots and machine learning models can all count. If your website, app or back-office software makes or shapes decisions that significantly affect customers, patients or applicants, this applies to you. This article is general information, not legal advice.

What must be disclosed

Under the new APP 1.7 and 1.8 requirements, your privacy policy needs to describe:

1. the kinds of personal information used in computer programs that make, or substantially relate to making, decisions
2. the kinds of decisions made solely by computer programs
3. the kinds of decisions where computer programs do things substantially related to making the decision

When it applies

All three of these must be true:

• A computer program makes the decision, or does something substantially related to making it.
• The decision could reasonably be expected to significantly affect an individual’s rights or interests.
• Personal information is used in the program’s operation.

Examples of significant effects include decisions about health, housing, finance, employment, utilities and access to significant services. A product recommendation widget probably is not covered. An automated system that declines a booking, sets a price, approves credit, ranks job applicants or flags a claim for review may well be.

Human review does not automatically get you out

A common assumption is “a person signs off, so it is not automated”. The guidance does not see it that way: if a tool’s output materially influences the decision, it can still be covered. A staff member who approves 99% of what a scoring tool suggests is not the whole decision.

Who this applies to

The obligation applies to organisations covered by the Privacy Act. Many small businesses with annual turnover of $3 million or less are still exempt, but the exemption has exceptions, including health service providers and businesses that trade in personal information. Since 1 July 2026, many businesses brought under the new anti-money laundering rules are also covered. If you are unsure, check with a privacy adviser.

A five-step plan before 10 December

1. Inventory your decision systems

List every tool that scores, ranks, approves, declines, prices, prioritises or flags people. Include spreadsheets with formulas, booking rules, fraud tools, chatbots and anything with “AI” in the name.

2. Decide which ones are significant

For each, ask whether the outcome could significantly affect someone’s rights or interests. Write down your reasoning.

3. Map the personal information

Record what personal information each system uses, where it comes from and who supplies the tool. Remember that the obligation sits with you as the user, not with the software vendor.

4. Update your privacy policy

Describe the kinds of decisions and information in plain English. Avoid vague statements like “we may use automated tools”.

5. Set up a review cycle

New tools get added quietly, especially AI features switched on inside existing software. Practice management systems such as Halaxy, for example, have released several AI features this year. Review the inventory every quarter.

Related obligations

• Statutory tort for serious invasions of privacy: in force since June 2025, allowing individuals to take action through the courts.
• OAIC infringement notices: the regulator now has more direct enforcement options.
• Children’s Online Privacy Code: being developed for services likely to be accessed by children.

Our article on security checks after the ASOS alert covers the security side of privacy compliance.

FAQ

Does a chatbot on my website count?

Only if it makes, or substantially contributes to, decisions that significantly affect people, using their personal information. A chatbot that answers FAQs is unlikely to; one that decides eligibility might.

Do I have to explain how the algorithm works?

The requirement is to describe the kinds of decisions and personal information involved, not to publish your code. Commercial confidentiality may limit some detail.

Sources

• OAIC: New resources on transparency for use of AI and automated decision-making
• Allens: Mandatory ADM disclosure requirements are coming