AMLCompliant, home

Privacy Act guide · general information, not legal advice

Automated decision-making disclosure by 10 December 2026

From 10 December 2026 an APP privacy policy must describe the kinds of personal information used, and the kinds of decisions made, when a computer program makes or substantially helps make significant decisions about people. This guide sets out the text of the new rule, what triggers it, what the policy has to say and what happens if it does not.

Last checked 25 September 2026 against the Privacy and Other Legislation Amendment Act 2024 (C2024A00128), the Privacy Act 1988 compilation C2026C00227 (compilation date 4 June 2026) and the Crimes (Amount of a Penalty Unit) Instrument 2026

POLA Act s 2 the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

At a glance

Automated decisions in privacy policies: APP 1.7 to 1.9
Question Answer Source
Starts 10 December 2026 POLA Act s 2
Applies to Decisions made after it starts, whenever the tool was set up or the information collected POLA Act Sch 1 item 89
Who APP entities: agencies, and organisations that are not small business operators. A small business that is an AML/CTF reporting entity is treated as an organisation for its AML/CTF activities s 6D(4) s 6E(1A)
Trigger A computer program makes, or does a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using personal information about the individual POLA Act Sch 1 item 88
What to disclose Kinds of personal information used; kinds of decisions made solely by the program; kinds of decisions the program substantially and directly supports POLA Act Sch 1 item 88
If you do not A breach of APP 1.7 is added to the low-tier civil penalty provision, s 13K POLA Act Sch 1 item 87

The text of the new rule

Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024 (the POLA Act) adds three subclauses to APP 1.1 POLA Act Sch 1 item 88 They are not in the current Privacy Act compilation, because they have not commenced, so we quote them from the POLA Act. APP 1.7 reads:

Without limiting subclause 1.3, the APP privacy policy of an APP entity must contain the information covered by subclause 1.8 if: (a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and (b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and (c) personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.

APP 1.9 adds four points. Making a decision includes refusing or failing to make one. Doing a thing includes refusing or failing to do it. A decision can affect rights or interests adversely or beneficially. And the kinds of decisions that may affect rights or interests include a decision under an Act or legislative instrument to grant or refuse a benefit, a decision that affects rights under a contract, agreement or arrangement, and a decision that affects access to a significant service or support.1

The start date comes from s 2 of the POLA Act: "the day after the end of the period of 24 months beginning on the day this Act receives the Royal Assent". Royal Assent was on 10 December 2024, so Part 15 commences on 10 December 2026.2 POLA Act s 2

What triggers it

Three conditions must all be met: a computer program and a decision, a significant effect on an individual, and personal information about that individual used in the program. The OAIC reads "computer program" broadly, to include rule-based processes, machine learning and generative AI tools such as chatbots.3 OAIC A person making the final decision does not take the tool outside the rule if its output is a key factor in, and directly connected with, that decision.3

For worked examples on both sides of the line, including rental application scoring, client risk scoring, recruitment filters and chatbots, read using AI: you may be making automated decisions.

What the policy must say

APP 1.8 lists the information the policy must contain:1

  • (a) the kinds of personal information used in the operation of such computer programs;
  • (b) the kinds of such decisions made solely by the operation of such computer programs; and
  • (c) the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.

The Act asks for kinds of information and kinds of decisions. It does not, in terms, require a list of every tool or an explanation of how each one works. Check the OAIC's guidance for what it expects. It also separates decisions a program makes on its own from decisions where a program supports a person. If you have none of the first kind, it helps to say so.

The OAIC's summary: from 10 December 2026, APP entities that use personal information in automated decision-making "with the potential to affect rights or interests will be required to provide information in their privacy policies about the kinds of personal information used and the kinds of decisions made using ADM".4 OAIC

How to write it

  1. Inventory the tools

    For each system that uses personal information to decide, score, rank, filter or recommend: what it does, the decision it feeds, whether a person reviews the output, and the personal information it uses. Include tools a supplier runs for you.

  2. Sort the decisions

    Put each in scope decision into one of two groups: made solely by the program, or made by a person with the program doing something substantially and directly related to it.

  3. Describe kinds, in plain words

    Name the kinds of decision and the kinds of information. APP 1.3 already requires a clearly expressed and up-to-date privacy policy. APP 1.3

  4. Add it to the privacy policy

    Put it under its own heading in the APP privacy policy, beside the matters APP 1.4 already requires.

  5. Review it when tools change

    An out-of-date description may no longer meet APP 1.7.

Illustration only: a fictional accounting practice

This shows the shape of a disclosure. It is not a template to copy, and it is not OAIC wording. Your wording must match your own tools and decisions.

Automated decisions

We use computer programs that use personal information in some decisions that could significantly affect you.

  • Decisions made solely by a computer program: we do not make any decisions of this kind.
  • Decisions where a computer program does something substantially and directly related to the decision: when you become a client, our client screening software gives a money laundering and terrorism financing risk rating. A staff member relies on that rating in deciding whether we need more information from you, and whether we can act for you.
  • Kinds of personal information used: identity details, such as your name, date of birth and address; information from your identity documents; the results of screening against sanctions and politically exposed person lists; and the kinds of services you ask us for.

Penalties

From 10 December 2026, APP 1.7 is added to the list of Australian Privacy Principles in s 13K(1)(b).5 POLA Act Sch 1 item 87 A breach of s 13K(1) carries a maximum of 200 penalty units.6 s 13K A body corporate faces 5 times that amount under Regulatory Powers Act s 82(5)(a).7 At the $364 penalty unit that applies to conduct on or after 1 July 2026, that is:8

Low-tier amounts for a breach of APP 1.7, at $364 a penalty unit
Body corporate Other person Source
Maximum civil penalty (s 13K) $364,000 (1,000 units) $72,800 (200 units) s 13K
Infringement notice, one contravention $21,840 (60 units); $72,800 (200 units) for a listed corporation $4,368 (12 units) for an individual s 80UB

The Commissioner can also give a compliance notice where the Commissioner reasonably believes an entity has contravened s 13K(1).9 s 80UC The note to s 13K says conduct that contravenes it may also contravene s 13G or s 13H, which carry higher penalties.6 See Privacy Act penalties 2026 for all three tiers.

OAIC guidance

On 18 May 2026 the OAIC opened consultation on an issues paper to inform its guidance on transparency in automated decision-making. Submissions closed on 15 June 2026. The OAIC said it intended to release guidance by September 2026, before the rule commences.4 OAIC Check the OAIC's website for the current version before you publish your wording.

Where to go next

Run the free Privacy Act checkerUse the free checklist

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.

Sources

Law is quoted from the authorised text on the Federal Register of Legislation, opened 25 September 2026. OAIC pages are guidance, not law. They open in a new window, and linking to them does not mean the OAIC endorses this page.

  1. Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024; C2024A00128), Schedule 1, item 88, inserting APP 1.7, 1.8 and 1.9 at the end of clause 1 of Schedule 1 to the Privacy Act 1988. legislation.gov.au/C2024A00128/latest/text

  2. Privacy and Other Legislation Amendment Act 2024, front page ("Assented to 10 December 2024") and s 2(1), table items 1 and 7. Schedule 1, item 89 applies the amendment to decisions made after commencement.

  3. OAIC, "Automated Decision-Making Issues Paper" (May 2026), "Meaning of computer program" and "Substantially and directly related to making a decision", quoting the Explanatory Memorandum to the Bill. Guidance, not law. oaic.gov.au (PDF)

  4. OAIC, "Consultation on Guidance for Transparency in Automated Decision Making", published 18 May 2026, and the issues paper. Guidance, not law. oaic.gov.au

  5. Privacy and Other Legislation Amendment Act 2024, Schedule 1, item 87, inserting s 13K(1)(b)(iia) of the Privacy Act 1988.

  6. Privacy Act 1988, s 13K(1), (3) and (4), and the note to s 13K(1). legislation.gov.au/C2004A03712/latest/text

  7. Regulatory Powers (Standard Provisions) Act 2014, s 82(5)(a). legislation.gov.au/C2014A00093/latest/text

  8. Crimes (Amount of a Penalty Unit) Instrument 2026 (F2026N00424): "the amount of a penalty unit is $364"; Crimes Act 1914, s 4AA. The amounts are our arithmetic: units multiplied by $364. legislation.gov.au/F2026N00424/latest/text

  9. Privacy Act 1988, s 80UB(1) and (1A) and s 80UC; Regulatory Powers Act s 104(2).

Questions

When does it start?

On 10 December 2026. Section 2 of the Privacy and Other Legislation Amendment Act 2024 starts Schedule 1, Part 15 on the day after the end of the 24-month period that began on the day of Royal Assent, 10 December 2024. The rule applies to decisions made after it commences (Schedule 1, item 89).

What must the policy say?

Three things (APP 1.8): the kinds of personal information used in the operation of the computer programs; the kinds of decisions made solely by the programs; and the kinds of decisions for which a program does a thing substantially and directly related to making the decision. The OAIC summarises it as information about "the kinds of personal information used and the kinds of decisions made using ADM".

Does it apply to a small business?

Only where the Privacy Act applies to you. A business with an annual turnover of $3 million or less is usually a small business operator and outside the Australian Privacy Principles, unless one of the cases in s 6D(4) applies. A small business that is an AML/CTF reporting entity is treated as an organisation for its activities connected with the AML/CTF Act, Regulations or Rules (s 6E(1A)), so the rule can apply to automated decisions made in that work.