Does Your Privacy Policy Need an Automated Decision-Making Statement by December 2026?

Detailed Explanation

Most Australian privacy discussion around AI has focused on what a business is allowed to feed into an AI tool. This requirement is about the opposite direction: what a business has to tell people about decisions an automated system makes, or materially helps make, about them.

The Privacy and Other Legislation Amendment Act 2024 inserted new transparency provisions into Australian Privacy Principle 1 — commonly referred to as APP 1.7 and 1.8 — which commence on 10 December 2026, 24 months after the amending Act received Royal Assent. From that date, an APP entity that arranges for a computer program to make, or substantially assist in making, a decision that could reasonably be expected to significantly affect an individual's rights or interests must say so in its privacy policy: specifically, the kinds of personal information used in that decision-making, and the kinds of decisions made using it.

This is a disclosure obligation, not a new right to object or a mandatory human-review requirement. Unlike the EU's GDPR, which gives individuals a right to contest a fully automated decision and, in some cases, demand human intervention, the Australian version only requires the privacy policy to name the practice — it doesn't require you to change how the decision is made, or offer an opt-out. That makes it a lower-friction compliance step than it might sound, but a real one: a privacy policy that's silent on automated decision-making, once your business is actually using it for a qualifying decision, will be non-compliant from the commencement date.

The definition is deliberately broad on the technology side and deliberately narrow on the impact side. It is not limited to AI or machine-learning systems — a rules-based scoring spreadsheet or an eligibility-checklist engine can trigger it just as easily as a trained model, because the trigger is what the decision affects, not how the program works. But it only applies where the decision could reasonably be expected to significantly affect someone's rights or interests — hiring, credit, insurance, pricing, or service eligibility are the clear cases; day-to-day operational automation with no real effect on a specific person generally isn't.

What the Privacy Policy Statement Needs to Cover

Once a business determines it has a qualifying automated decision-making process, the privacy policy needs to state, at minimum:

• The kinds of personal information used in the automated decision-making — not necessarily a field-by-field list, but a genuine description of the categories involved (application details, transaction history, behavioural data, and so on).
• The kinds of decisions made using it — described specifically enough that a reader understands what's actually being decided (loan approval, job-application screening, pricing eligibility), not a vague reference to "automated processes."

The OAIC published its supporting resources and updated APP 1 guidance on 30 September 2026. The fact sheet and flowchart confirm that the policy must distinguish decisions made solely by a computer program from decisions where the program performs something substantially and directly related to making the decision. A vague statement that the business "may use automated systems" does not identify the required kinds of information and decisions.

Does Your Business Actually Need One?

Work through this in order:

1. Confirm you're an APP entity. Most businesses with turnover over $3 million are; some smaller businesses are too, depending on what they handle (health information, credit reporting, and a few other categories). If your business sits outside the APPs entirely under the existing small-business exemption, this amendment doesn't change that.
2. Inventory where a computer program makes or substantially assists a decision about a specific person. This includes AI tools, but also older rules-based systems that predate any "AI" branding — a lead-scoring formula, an automated eligibility check, a fraud-flagging rule set.
3. Filter for genuine significance. Only decisions that could reasonably be expected to significantly affect someone's rights or interests trigger the requirement — see how do you reduce bias and discrimination risk in AI-automated decisions about people for the adjacent question of which processes carry the highest scrutiny generally; the same list (hiring, credit, insurance, pricing) is the practical starting point here too.
4. Draft the statement and add it to your privacy policy before 10 December 2026. This sits alongside, not instead of, your existing Privacy Act obligations — see does GDPR apply to a business using AI tools if you also have EU exposure, since GDPR's Article 22 automated-decision-making right is a separate and stricter requirement layered on top for that audience.

Things to Consider

• This is additive to your existing privacy policy, not a replacement for it. The ADM statement is a new required section, not a reason to rewrite the whole document.
• The OAIC has now published implementation resources. Use the current APP 1 guidance, fact sheet and flowchart when documenting the assessment rather than relying on the earlier consultation paper.
• A rules-based tool doesn't get a pass because it "isn't really AI." The obligation is written around what the decision affects, not the underlying technology — a legacy scoring spreadsheet used for something like a credit decision is squarely in scope.
• The policy statement still has to match the real system. The OAIC resources explain the test, but they do not turn one generic paragraph into a safe template for every organisation. Document the actual categories of information and decisions used by the business.

Common Mistakes

• Assuming this only applies to AI tools. The trigger is the decision's effect on a person, not whether machine learning is involved — rules-based systems making significant decisions are equally in scope.
• Waiting until close to December 2026 to check. The OAIC resources are now available, so there is no need to wait for further general guidance before identifying relevant systems and drafting the disclosure.
• Writing a vague, catch-all statement instead of an accurate one. A generic line like "we may use automated systems" does not state the kinds of personal information used or the kinds of decisions involved.
• Treating this as a substitute for reviewing whether the automated decision is fair. Disclosure and fairness are separate questions — see how do you reduce bias and discrimination risk in AI-automated decisions about people for the substantive review this statement doesn't replace.