Automated Decision-Making and the Privacy Act: What to Know
If your business uses any software to help decide who gets approved, flagged, prioritised, or declined, a new automated decision-making rule under the Privacy Act, starting 10 December 2026, may already apply to you, whether or not you think of that software as “AI.”
This matters now because the Office of the Australian Information Commissioner (the OAIC, Australia’s privacy regulator) published its final guidance on this rule on 30 September 2026, and the compliance deadline sits only about ten weeks after that. Most businesses have not yet checked whether their existing tools, not just new AI products, fall inside the new disclosure duty.
From 10 December 2026, Australian Privacy Principle 1.7 requires any business covered by the Privacy Act to disclose in its privacy policy when a computer program makes, or materially contributes to, a decision that could significantly affect a person’s rights or interests. The rule is about transparency, not a ban on automation, and it applies whether or not the tool involved is marketed as AI.
What Is Automated Decision-Making Under the Privacy Act?
Automated decision-making, often shortened to ADM, is the Privacy Act’s term for a decision made, or substantially shaped, by a computer program rather than entirely by a person. It is a broader category than “AI” in the popular sense. A rules-based eligibility calculator, a credit scoring tool, and a generative AI system can all qualify, because the test is about the program’s role in the decision, not the technology behind it.
The new obligation sits in Australian Privacy Principle 1.7, which was added by the Privacy and Other Legislation Amendment Act 2024. It requires an APP entity’s privacy policy to describe the use of ADM where three conditions, set out in APP 1.7 and 1.8, are all met at once. The next section covers those conditions directly.
Does the New Rule Apply to You?
Three conditions all need to be true before the disclosure duty is triggered. If any one is missing, the rule does not apply to that particular tool or process.
| Condition | What it means in practice |
|---|---|
| A computer program is involved | The program makes the decision itself, or does something substantially and directly related to making it. Human review afterward does not remove the program from scope. |
| The decision could significantly affect rights or interests | Think credit, insurance, employment, access to a service, or eligibility for something material. Minor, low-stakes outcomes are less likely to qualify. |
| Personal information is used | The program uses information about the specific person the decision concerns, not aggregated or anonymous data. |
A genuinely manual decision that a staff member makes, with a dashboard or report simply informing their judgement, is unlikely to meet the first condition. But once software is scoring, ranking, shortlisting, or auto-declining based on someone’s personal information, it is worth assuming the rule applies until you have checked otherwise.
What Do You Actually Have to Disclose?
Your privacy policy needs to describe two things, in plain language rather than technical or legal detail: the kinds of personal information used by the relevant computer programs, and the kinds of decisions those programs make or substantially contribute to.
You are not required to disclose commercially sensitive detail, trade secrets, or the exact workings of a proprietary algorithm. The OAIC’s guidance is explicit that this is a category-level disclosure, not a technical specification. A line describing that your business uses an automated tool to assess loan applications using income and credit history, for example, meets the intent of the rule without exposing how the scoring model itself works.
This also is not a right-of-appeal rule. It does not require you to let someone contest an automated decision or insist on a human review. It only requires that the fact of automation, and the kind of data and decision involved, is disclosed where someone would reasonably look for it.
What Tools Commonly Trigger This, and Who Is Most Exposed?
Financial services and healthcare businesses, two of the sectors Akoora works with most, are particularly likely to have several tools already in scope without having thought of them that way.
In financial services, credit and loan eligibility scoring, fraud flagging, and automated risk tiering for insurance commonly meet all three conditions. In healthcare, intake triage tools, appointment prioritisation software, and eligibility checks for subsidised services or programs can also qualify, especially where they use a patient’s own information to shape what happens next.
Professional services firms are not exempt either. Automated shortlisting in recruitment, automated approval or decline of credit terms for clients, and scoring tools used in underwriting or claims assessment all fit the same pattern. The common thread is not the industry. It is whether a computer program’s output meaningfully shapes an outcome that matters to a specific person.
What Should You Do Before 10 December 2026?
Work through this in order. Each step is a prerequisite for the one after it.
- List every computer program involved in a decision about a person. Include commercial software and tools you bought, not only systems your business built. The disclosure duty falls on the business using the tool, not the vendor that built it.
- Test each one against the three conditions above. Note which programs use personal information, which make or substantially shape a decision, and which of those decisions could significantly affect someone’s rights or interests.
- Draft plain-language descriptions for anything in scope. Describe the kinds of personal information used and the kinds of decisions made, at the level of detail the OAIC’s guidance calls for, not a technical specification.
- Update your privacy policy before the deadline. Build in time for legal review given the limited window remaining.
- Set a review point for new tools. Any new software introduced after 10 December 2026 that touches a decision about a person needs the same test applied before it goes live, not after.
Who Should Own This Inside Your Business?
This is not purely a legal or IT task, because the first step, listing every computer program involved in a decision about a person, requires input from whoever actually runs operations day to day, not just whoever manages compliance documents.
In most mid-size Australian businesses, the CFO or COO is the practical owner, since they are the ones who can see across departments to the finance, operations, and client-facing tools in use. Legal or a compliance lead should own the actual privacy policy wording once the list of in-scope tools is settled. IT can confirm what software is technically running, but should not be left to decide alone which tools meaningfully affect someone’s rights or interests. That judgement call belongs with the business, not the technology.
How Do You Get Started Without Guessing?
The hardest part of this is rarely the legal wording. It is the first step: knowing, with confidence, every system across your business that touches a decision about a real person, including tools other teams adopted without flagging them centrally.
An AI Readiness Audit covers exactly this ground, mapping your people, process, data, and technology so you know what is actually running before you try to describe it in a privacy policy. For businesses that find several tools in scope and want a proper plan for governing them going forward, not just a one-off policy update, an AI Strategy & Roadmap sets out how to manage that properly as your use of these tools grows.
This kind of gap is also why most AI initiatives stall before they help anyone: businesses move to the tool before mapping what it actually touches. Our guide to why most AI projects fail covers the same pattern in a different context, and last week’s guide on AI agent readiness covers a closely related governance question for a different kind of automated tool.
Frequently Asked Questions
What is automated decision making under the Privacy Act?
It is any case where a computer program makes a decision, or does something substantially and directly related to making one, using a person’s personal information, where that decision could significantly affect their rights or interests. A human reviewing the output before it takes effect does not remove it from scope.
Does the new rule apply to small businesses?
The automated decision-making disclosure duty applies to APP entities under the Privacy Act, which broadly means organisations with annual turnover above $3 million, plus some others regardless of turnover. Most mid-size Australian businesses are well above that threshold.
What happens if our privacy policy is not updated by 10 December 2026?
The OAIC can issue compliance notices and infringement notices, with penalties of up to $66,000 for a non-compliant privacy policy, according to law firm Allens’ analysis of the OAIC guidance, published 2 October 2026. The regulator has also signalled it is increasing privacy enforcement generally, so this is not a rule likely to go unchecked.
Does this apply to software we bought rather than built ourselves?
Yes. As Allens notes in its 2 October 2026 analysis, the duty falls on the business using the tool, not the vendor that built it. A commercial product, a spreadsheet with a scoring formula, or a plugin inside existing software can all trigger the rule if it meets the three conditions in APP 1.7.
Do customers get a right to challenge an automated decision about them?
No. This is a transparency obligation only. It requires your privacy policy to disclose that automated decision-making happens and what kinds of information and decisions are involved. It does not create a right to human review or a right to contest the outcome.
The Takeaway
The Privacy Act’s new automated decision-making rule is a transparency duty, not a ban, but it applies more broadly than most businesses assume, to ordinary software as well as AI, and the window to prepare closes on 10 December 2026. The real work is the audit: knowing every tool that touches a decision about a person, before you try to describe it in a privacy policy.
Not sure which of your systems would meet the three conditions above, or where to start? An AI Readiness Audit maps it properly before the deadline arrives. Book a conversation →
AI assisted with the research, structure, and editing of this article. The views and recommendations are Akoora’s own.