Many Australian businesses use automated decision-making to support their decision-making processes. Whether that be reviewing job applications, sorting customer queries, identifying accounts to review or scoring applications, there hasn’t been any specific requirement for businesses to disclose this in their privacy policy.
However, this is changing. From 10 December 2026, a new transparency requirement applies under the Privacy Act. This is one of the most tangible Australian Privacy Act 2026 changes, and it will cause many leadership teams to ask themselves: “Do we actually know where we’re using software to make or influence decisions?”
What’s changing?
The requirement was added to Australian Privacy Principle (APP) 1 under the Privacy and Other Legislation Amendment Act 2024.
From 10 December 2026, APP entities must include information in their privacy policy if they have arranged for a computer program to make or inform decisions that have a significant impact on the rights or interests of individuals.
If you are using software to make decisions that will have a real impact on individuals, you’ll need to include this in your privacy policy.
Three Criteria
Not all software will trigger this requirement. There are three criteria that must be met under APP 1.7.
- The computer program: Your entity has arranged for a computer program to make a decision or do something substantially and directly related to making a decision.
- Significant impact: The decision could reasonably be expected to have a significant impact on an individual’s rights or interests.
- Personal information: Personal information relating to the individual is used in the operation of the computer program.
If you meet all three criteria, you’ll need to include this information. If you don’t meet all three criteria, you won’t. This is where most of the time will be spent. The OAIC has created a handy flowchart to help entities determine if they meet the requirements.
What should I include?
Once all three criteria have been met, you must include the following information under APP 1.8.
- The types of personal information used in the operation of computer programs.
- The types of decisions made solely by the operation of computer programs.
- The types of decisions where something substantially and directly related to making a decision has been performed by computer programs.
This is not a detailed list of decisions made. It is a general description of the type of information used and decisions made. You can’t describe something you haven’t mapped. To get started, you’ll need to understand what your systems are actually doing.
Where businesses commonly miss this
Most commonly, this is due to a lack of visibility. Often automation is implemented by one team to solve one issue. Recruitment platforms, customer service tools, and fraud screening and scoring in existing platforms can all be doing more than the leadership team may realise.
Ask yourself the following questions.
- Do any of our tools rank, filter, score or recommend outcomes for individuals?
- Are they using personal information relating to our customers, applicants or staff?
- Would the outcome reasonably be expected to have a significant impact on someone’s rights or interests?
- Does anyone in the business have an up-to-date list of the tools and what they do?
If the answer to the last question is no, this is your first step. Many organisations will find that the decision-making is done by a third-party provider. The OAIC has a helpful fact sheet about this.
What should I do now?
There is no need to do anything huge to comply with this requirement in Australia in 2026. However, you should start now. A good approach would be:
- Create a list: Make a list of all your systems that use automation that impacts individuals’ information.
- Use the three criteria: Document why you have come to your conclusion, even if you don’t meet all the criteria.
- Write the disclosure: Write your new section in plain English.
- Assign an owner: Assign someone at a senior level to ensure the list and policy remain in line.
- Schedule a review: If you add a new tool next year, you should review your policy.
The OAIC has examples in its Transparency Obligation Fact Sheet. The updated APP 1 Guidelines are available on its website, and government agencies have a separate fact sheet. These resources reflect feedback from 90 written submissions from government, industry, academia, civil society and other stakeholders.
Why this is a governance issue
It can be tempting to think this is a simple edit to a webpage. However, you will only be able to disclose this accurately if you have visibility of what your systems are doing, who approved them and how they are reviewed.
This is a governance issue. It falls under your risk register, supplier management and AI transparency requirements in Australia. Having a policy that doesn’t accurately describe automation you’ve never really looked at is a risk. It may not be accurate on the day you publish, or each time you change a tool.
At Anitech, we work with Australian organisations to develop their governance around obligations like this. By mapping your automation, assigning clear owners and documenting decisions, you will have an accurate and defensible policy. This will sit within your existing information security and privacy governance practices.
Summary
This will come into effect on 10 December 2026. The actual work to complete between now and then is simple: locate your automation, use the three criteria, and truthfully describe it in your privacy policy.
If you start looking at this in November, you’ll have plenty of time to do it properly. If you leave it until December, you’ll be guessing.
If you’d like help working out where you are, visit anitechgroup.com.
Recent Comments