Automated Decision-Making Privacy Disclosures Australia 2026

Does the 10 December 2026 change apply to my business?

The requirements apply to APP entities, including Australian Government agencies and private organisations covered by the Privacy Act 1988. Private businesses with annual turnover above $3 million are generally covered, subject to exceptions. Some smaller businesses are also covered, including private health service providers.

The amendments sit in Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024 and introduce APPs 1.7 to 1.9. Establishing whether your organisation is covered comes before deciding what to publish. A trading name, software licence or group privacy policy does not tell us enough about your particular arrangements.

Bring your current privacy policy and an explanation of which business contracts with customers, employs staff and engages the technology provider. NS Legal identifies which entity is responsible for the disclosures, taking account of its activities and any applicable exemption.

Which automated decisions need to be disclosed?

APP 1.7 requires all three conditions to be met: the entity has arranged the relevant computer involvement, the decision could significantly affect an individual’s rights or interests, and personal information about that individual is used in the program’s operation.

The test extends beyond generative AI. Rule-based software can qualify, and a recommendation may qualify even where a manager makes the final decision. Conversely, using a word processor only to record a decision already made does not trigger the requirement on that basis.

Assess recruitment rankings, eligibility checks and account restrictions against their actual effect. The significance of an outcome can depend on the person’s circumstances. Decisions that benefit someone can also fall within scope.

NS Legal works with your operational staff to identify which decisions require disclosure, examining the system’s output, staff reliance on it and the authority to change a result.

What must the privacy policy say about the data and decisions?

APP 1.8 requires three categories of information where the conditions are met:

• The kinds of personal information used by the relevant programs.
• The kinds of relevant decisions made entirely by those programs.
• The kinds of relevant decisions to which the programs contribute substantially and directly.

Descriptions should be meaningful to the people affected. Identify the information actually used in each process, such as qualifications, employment history or transaction records, rather than copying a generic list from the software supplier. OAIC guidance calls for clear disclosure where sensitive information, such as health information, informs the decision.

OAIC guidance distinguishes commercial-in-confidence information from information that merely has commercial value; commercial value alone does not justify concealing how a system is used.

NS Legal drafts clear descriptions of the decision categories and data used, while addressing any confidential technical information.

Do recruitment tools and outsourced systems need separate attention?

The employee records exemption does not extend to future employment relationships. In particular, collecting information about unsuccessful applicants cannot be treated as exempt simply because it occurs during recruitment. A recruitment provider handling another employer’s employee information cannot simply rely on that employer’s exemption either.

Outsourcing a decision-making tool also requires examination of your own responsibilities. The OAIC expects entities to understand third-party programs used to make or assist relevant decisions, including the contractual allocation of decision-making responsibility.

NS Legal reviews data-use and change-notification provisions in your supplier commercial contracts and aligns the recruitment process with related employment contracts.

How should we manage policy updates and privacy complaints?

APP 1 already requires a clearly expressed, current privacy policy covering matters including access, correction and complaints. The new disclosure requirements add to those obligations. The policy must also state whether overseas disclosure is likely and, if so, identify the likely recipient countries where practicable.

For a focused review, prepare your policy, supplier documents and a list of decision processes. Record the information entering each system, the output and the role of staff.

Existing rules about collecting, using and disclosing personal information continue to apply to AI. Publishing a revised policy does not itself authorise every proposed use. NS Legal prepares policy review and complaint handling procedures and advises on your proposed data uses.

Compiled from official sources; updated 29 October 2026.