Automated decisions in your privacy policy (APP 1.7–1.9): what must be disclosed from 10 December 2026

What changes. The Privacy and Other Legislation Amendment Act 2024 added a transparency obligation to APP 1, in APP 1.7 to 1.9. According to the OAIC, it starts on 10 December 2026. From that date an APP entity's privacy policy must carry extra information if the entity uses a computer program to make decisions about people, or to do something substantially and directly related to making them. On 30 September 2026 the OAIC published a fact sheet, a supplementary fact sheet for government agencies, a flowchart and an updated Chapter 1 of the APP Guidelines. It says these reflect 90 written submissions to its consultation.

The three-part test (APP 1.7)

All three limbs must be met. (a) The entity has arranged for a computer program to make a decision, or to do a thing substantially and directly related to making one. (b) The decision could reasonably be expected to significantly affect an individual's rights or interests. (c) Personal information about that individual is used when the program makes the decision or does the thing. The OAIC's advice for borderline cases is to take a cautious approach and include the information in the privacy policy.

'Computer program' and 'decision' are read broadly

The OAIC says a computer program includes pre-programmed rule-based processes, AI and machine learning, ordinary software, apps and word-processing tools, and generative AI that produces text, images, video or code, including chatbots. One of its own examples is a spreadsheet formula that scores and ranks clients for health and aged care services. A program used only for something other than the decision itself, such as typing up a decision a human has already made, is not captured (APP Guidelines, para 1.40).

Under APP 1.9 a decision includes refusing or failing to make a decision or do a thing. It counts whether the person is helped or harmed. The OAIC's spreadsheet example stays in scope even if staff use the rankings to decide whom not to contact.

Human review does not take you out of scope

This is the point most teams get wrong. 'Substantially' means the program is a key factor in a human's decision. 'Directly' means it has a direct connection to the decision. The OAIC says the output can be advisory or determinative. It says machine learning or generative AI outputs used to make significant decisions would generally be in scope unless subject to extensive human oversight and control. A decision can also be in scope when the program does not replace the whole process, or when a human reviews the result.

To test an advisory tool, the APP Guidelines (para 1.53) tell you to weigh four things: how heavily staff rely on the output; whether staff can override it and how often they do; whether the tool explains what it did and why; and how deeply it is built into the workflow. In the OAIC's fact sheet, managers use a generative AI report to suggest bonuses and pay rises. That use is in scope even though a director signs off every decision in writing, because the report is relied on to record the reasoning. The OAIC says it might fall outside scope if staff questioned the outputs, reviewed the underlying performance indicators themselves, used other evidence and recorded why they departed from the recommendation.

'Significantly affect'

The OAIC says 'significantly' means the effect must be more than trivial and could considerably influence the person's circumstances or outcomes. Vulnerability matters too. If a program's output is materially different for a vulnerable group than for the general population, the APP Guidelines (para 1.66) say the decision should be treated as significant. The fact sheet's pricing example says differential pricing of essential goods is significant even when the price gaps are small, because they add up over time.

The OAIC's non-exhaustive list of decisions that would generally be in scope: facial recognition watchlist matching in shops or stadiums; recruitment software that sorts candidates; differential or personalised pricing of significant goods; prioritising health or disability services; eligibility for government benefits, housing, education or training; approving or rejecting loan or credit applications; programmatic advertising tied to selling significant goods or services; insurance eligibility; AI reports that rank staff performance or set promotions or pay; scholarships, grants and other financial support; and immigration processing or border control at airports.

Security teams should take note. The APP Guidelines give an example of a rideshare program that can suspend a customer's account. The fact sheet's bank example lists fraud tools that grant or deny access to accounts, transactions and loan applications. Automated fraud, account-suspension and access decisions belong in the inventory.

What the privacy policy must say (APP 1.8)

If the test is met, the policy must state three things: the kinds of personal information used by those programs; the kinds of decisions made solely by the programs; and the kinds of decisions where a program does something substantially and directly related to the decision. You may group decisions and types of information into categories, but the OAIC says the detail must still be meaningful to a reasonable person. Make it clear when more sensitive information, such as health information or biometric templates, is used. Do not bury readers in technical detail. Structure the section so people can ask for more information and so the decision can be reviewed.

Vendors and 'arranged for'

Buying a tool does not move the duty to the vendor. The OAIC lists in-house software, procured third-party programs, configured or customised off-the-shelf software, programs authorised to make a final decision, and reliance on advisory outputs as ways an entity can 'arrange for' a program. It expects the obligation will usually stay with the entity that uses personal information to make the decision. It says providers should give clear, high-level information about how their software can be used to make decisions, so customers can write their policies. The APP Guidelines (para 1.45) add that entities should identify, assess and oversee third-party programs during and after procurement, and make their contracts clear about which party keeps the ultimate decision-making power.

The commercial-in-confidence carve-out is narrow

Commercially sensitive information and trade secrets about a program do not have to be disclosed. The APP Guidelines say the exclusion covers information whose release could harm the entity's commercial interests, a narrower category than information that merely has commercial value. The OAIC's fact sheet adds that information whose release would only expose the entity to ridicule, embarrassment or public criticism is not covered. In the OAIC's bank example, the weightings a proprietary fraud model applies can stay out of the policy, but the fact that personal information powers fraud detection cannot.

Six-week readiness checklist

1. Inventory every system that scores, ranks, approves, denies, prices, flags or suspends people. Include SaaS features, spreadsheet formulas and generative AI used by staff, not only systems labelled 'AI'. 2. For each one, record the kinds of personal information it uses, the kinds of decisions it makes, and whether it decides alone or supports a human. Apply the four reliance factors honestly, using real override rates rather than the process on paper. 3. Ask vendors for the high-level description the OAIC expects them to provide, and check your contracts say who holds final decision-making power. 4. Draft the new privacy policy section, using categories that mean something to a customer, and have it approved before 10 December 2026. 5. Write down any commercial-in-confidence exclusion with a reason that meets the narrow test. 6. Add the inventory to your regular privacy policy review. The APP Guidelines suggest reviewing at least yearly as part of annual planning, and new tools change the answer. Government agencies should also read the OAIC's supplementary fact sheet, which covers Freedom of Information and other transparency issues.

Desk note: this page summarises OAIC guidance published 30 September 2026 and fetched 24 October 2026. It is not legal advice. The Act and the OAIC's APP 1 Guidelines are the authority.