Quick Summary
Overview: New Australian Privacy Principle provisions will require regulated entities to make particular automated decision-making uses visible in their APP Privacy Policies. The obligation covers more than AI and can include computer programs that make, or directly support, significant decisions.
- The new APP 1.7 to 1.9 requirements commence on 10 December 2026.
- They apply where personal information is used and a decision could significantly affect rights or interests.
- Privacy policies must describe the kinds of information used and relevant kinds of decisions.
- Practical next step: Inventory automated decisions now and identify which ones use personal information.
Photo by Daniil Komov on Unsplash. Used under the Unsplash License.
Businesses increasingly use software to score, rank, recommend, approve, decline and prioritise. From 10 December 2026, some of those systems will need to be described more clearly in the organisation's APP Privacy Policy.
The change comes from the Privacy and Other Legislation Amendment Act 2024, which adds clauses 1.7, 1.8 and 1.9 to Australian Privacy Principle 1.
It is an important transparency requirement, but it is more specific than a general duty to explain every algorithm. The legal test and the information that must be published both matter.
The OAIC guidance is now published
From 10 December 2026, APP entities must address APP 1.7-1.9 where they have arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests and personal information is used in the program.
- Is the organisation an APP entity?
- Has it arranged for a computer program to make or materially inform the relevant decision?
- Could the decision significantly affect rights or interests?
- Is the individual's personal information used in the program?
- If all apply, does the privacy policy describe the kinds of information and decisions required by APP 1.8?
The obligation concerns transparency in an APP privacy policy. It does not create a general right to human review. Consult the OAIC's current chapter 1 guidance, fact sheet and flowchart for scope and exclusions.
Sources and currency
Jurisdiction: Australia. Currency: Sources checked 27 October 2026. Legislation is binding where it applies; regulator and government material is guidance unless stated otherwise. Standards and recommended governance practices are not legislation. Check the instrument, jurisdiction and facts that apply to you.
Related Articles
AI, Privacy and Worker Data
What workplaces need to consider when AI handles personal information.
Read article →
Human Oversight of AI
What meaningful review looks like when AI assists important decisions.
Read article →
AI Use Registers
A practical first step for making workplace AI systems visible and accountable.
Read article →Frequently Asked Questions
When do the new automated decision transparency obligations start?
The new APP 1.7 to 1.9 requirements commence on 10 December 2026 and apply to relevant decisions made from that date.
Do the obligations apply only to artificial intelligence?
No. The legislation refers to computer programs and can cover rules-based automation as well as AI or machine learning.
What must an APP Privacy Policy disclose?
It must describe the kinds of personal information used and the relevant kinds of decisions made solely by programs or substantially and directly supported by programs.
Does every Australian business have to comply?
The obligation applies to APP entities. Businesses should check whether the Privacy Act applies to them, including any small-business exemption or exception.
Key Facts
- The new transparency obligation commences on 10 December 2026.
- It applies to computer programs, not only systems labelled as AI.
- Personal information and a potentially significant effect on rights or interests are both part of the test.
- The obligation can cover a program that directly supports a human decision.
- The required disclosure belongs in the entity's APP Privacy Policy.
Useful Australian Resources
These links are provided for general education and context. They are not a substitute for advice about your organisation's circumstances.
- OAIC: APP 1 and the new automated decision obligations
- Privacy and Other Legislation Amendment Act 2024
- OAIC: Privacy and commercially available AI products
In Short
From 10 December 2026, APP entities must add specified automated decision-making information to their privacy policies when the legal test is met.
Next step: Inventory automated decisions, map personal information and prepare clear privacy-policy disclosures before commencement.