Australia: from 10 December 2026, privacy policies must disclose automated decisions that use personal information

Australia: from 10 December 2026, privacy policies must disclose automated decisions that use personal information

1 October 2026 — Organisations covered by Australia's Privacy Act have ten weeks to update their privacy policies. From 10 December 2026, an entity bound by the Australian Privacy Principles (an "APP entity") must say in its privacy policy when it has arranged for a computer program to make, or substantially inform, decisions that could significantly affect people. The Office of the Australian Information Commissioner (OAIC) published guidance, a fact sheet and a flowchart on 30 September 2026.

Not yet independently verified. This rests on the OAIC’s own announcement; no independent report was checked, and the fact sheet and flowchart were not opened. We will update this when it can be confirmed, and remove this note.

What the rule requires

The obligation was added to APP 1 by the Privacy and Other Legislation Amendment Act 2024. Under APP 1.7, the disclosure is required when all three of these apply:

• the entity has arranged for a computer program to make a decision, or to do something "substantially and directly related to making a decision";
• the decision "could reasonably be expected to significantly affect the rights or interests of an individual"; and
• personal information about the individual is used in the operation of the program.

APP 1.8 says what the privacy policy must then include:

• the kinds of personal information used by such programs;
• the kinds of decisions made solely by such programs; and
• the kinds of decisions where such a program does something substantially and directly related to making the decision.

The OAIC says its resources reflect 90 written submissions to its consultation, and it has updated its APP 1 Guidelines. There is a supplementary fact sheet for government agencies.

Who it affects

APP entities include most Australian government agencies and businesses with an annual turnover above A$3 million, plus some smaller ones such as health-service providers. The rule is not limited to AI: any automated system counts, including rules engines and scoring models. Typical cases are credit and lending decisions, insurance pricing and claims triage, fraud blocks, tenant and job-applicant screening, and access to services or benefits.

What to do

• Inventory the automated decisions that use personal information and could significantly affect people, including those made inside software you buy, such as screening, scoring and fraud tools.
• Sort them into decisions made solely by a program and decisions it substantially informs. The policy must describe both kinds.
• Update the privacy policy before 10 December 2026 with the kinds of personal information and the kinds of decisions involved.
• Ask your software vendors what their products decide automatically and with what data, so your disclosure is accurate.
• Read the OAIC fact sheet and flowchart and the updated APP 1 Guidelines before drafting.

Sources

• Office of the Australian Information Commissioner: New resources on transparency for use of AI and automated decision-making — 30 September 2026