Australian businesses have until 10 December 2026 to prepare for new privacy policy requirements covering automated decision-making. The Office of the Australian Information Commissioner (OAIC) has released guidance and practical resources for organisations covered by the Australian Privacy Principles (APPs).
What are the new rules?
The new rules, introduced by the Privacy and Other Legislation Amendment Act 2024, apply when an organisation has arranged for a computer program to make a decision—or perform an activity substantially and directly related to making one—where personal information is used and the outcome could reasonably be expected to significantly affect someone’s rights or interests. Decisions affecting access to employment, credit, contracts or significant services may be in scope. The rules also cover decisions that benefit a person, as well as those that disadvantage them. OAIC guidance · Legislation
Under APP 1.7 and 1.8, an organisation’s privacy policy must describe the kinds of personal information used by the relevant programs, and the kinds of decisions made solely by those programs or informed by their outputs. The obligation is not limited to systems that make the final call: a tool that recommends or guides a human decision may also be covered. The OAIC says this can include generative AI and other commonly used software. OAIC APP 1 Guidelines
What does this mean for businesses?
For businesses, this could bring familiar processes into scope. A system that screens job applicants or ranks candidates may affect employment opportunities. Automated credit scoring or onboarding checks could influence access to financial services. Fraud detection tools may flag transactions, restrict accounts or deny access. Whether a particular system is covered depends on how it is used, what personal information it processes and the likely effect of its decisions—not simply whether the vendor calls it “AI.”
Organisations will need to look beyond their own software. The OAIC says an entity may still have obligations where a provider supplies the program under contract. That makes it important to map decision-making tools across business units, identify the data they use and understand where automated outputs materially shape outcomes.
How should businesses prepare for the changes?
The required disclosure belongs in the privacy policy. The OAIC’s guidance calls for clear, accessible and meaningful descriptions, while allowing related processes to be grouped where that still helps people understand them. Commercial-in-confidence information and trade secrets are excluded, but the regulator cautions that this is a narrow exclusion. The new requirement is a transparency obligation; it does not, by itself, require businesses to publish source code or provide an individual explanation of every decision. OAIC APP 1 Guidelines
Preparation will likely involve privacy, legal, HR, risk, procurement and technology teams. They can start by creating an inventory of automated tools, documenting the categories of information and decisions involved, checking vendor arrangements, and updating privacy policies before the commencement date. The OAIC’s published fact sheet and flowchart offer further guidance.
Key points
- From 10 December 2026, covered APP entities must disclose relevant automated decision-making practices in their privacy policies.
- Systems that substantially guide important decisions may be covered even when a person makes the final decision.
- Businesses should map tools, data and decision impacts now, then write clear, appropriately specific policy disclosures.
Implementing an AI Management System such as ISO 42001 can help organisations understand the impacts of AI usage and comply with changes to the Privacy Act.
Need help applying this to your organisation? Talk to Cybervisory.