Does your privacy policy need to disclose automated decision-making?

Introduction

You have automated part of your credit assessment process.

A computer program reviews each application, analyses the applicant’s personal information and recommends whether credit should be approved.

A staff member still makes the final decision. In practice, however, the program’s recommendation is a key part of the decision. Your privacy policy says nothing about the information used or the decisions the program helps make.

From 10 December 2026, that omission may mean your privacy policy does not comply with APP 1.

When must my business disclose automated decision-making?

On 10 December 2026, amendments made by the Privacy and Other Legislation Amendment Act 2024 (Cth) (Amending Act) will add subclauses 1.7 to 1.9 to APP 1 in Schedule 1 to the Act.¹

From that date, a business subject to the Act must include additional information in its privacy policy if all of the following apply:

• the business has arranged for a computer program to make a decision or do something substantially and directly related to making it;
• personal information about an individual is used in the operation of the program; and
• the decision could reasonably be expected to significantly affect the individual’s rights or interests.²

The requirement can apply even where a person makes the final decision if the program performs a step substantially and directly related to making it.³

What decisions significantly affect a person’s rights or interests?

The new APP 1.9 does not exhaustively define when a decision will significantly affect a person’s rights or interests. However, it gives examples of decisions affecting:

• the granting or refusal of a benefit under legislation;
• rights under a contract, agreement or arrangement; or
• access to a significant service or support.⁴

For these purposes, ‘making a decision’ includes refusing or failing to make one. A decision may affect a person’s rights or interests whether the effect is adverse or beneficial.⁵

“The effects must be more than trivial, and must have the potential to significantly influence the circumstances of the individual concerned.”⁶

Whether the effect is significant will depend on the circumstances. A decision may have a greater impact on a child or vulnerable person than on another individual.⁷

The Office of the Australian Information Commissioner (OAIC) is developing detailed guidance on these new obligations, which it intends to release by September 2026.⁸

What must my privacy policy disclose?

Under the new provisions, if APP 1.7 applies, APP 1.8 requires the business’s privacy policy to describe:

• the kinds of personal information used in the operation of the computer program;
• the kinds of decisions made solely by the program; and
• the kinds of decisions where the program performs a step substantially and directly related to making the decision.⁹

For example, a lender may need to disclose that its credit assessment software:

• uses information about an applicant’s identity, income, employment and credit history;
• automatically declines applications that do not meet specified eligibility criteria; and
• assesses other applications and recommends whether credit should be approved, with the final decision made by a staff member.

What should my business do to prepare for 10 December 2026?

Businesses, particularly more established ones, should use these changes as an opportunity to review how they collect, use and disclose personal information.

Businesses should consider:

• mapping the data-handling processes connected with each product or service;
• identifying any computer programs that use personal information to make or assist with decisions;
• assessing whether those decisions could significantly affect a person’s rights or interests;
• updating their privacy policy where the new disclosure requirements apply; and
• obtaining legal advice where the application of the new requirements is uncertain.

Key takeaway for business owners

As technology advances, personal information is becoming increasingly central to how businesses deliver products, provide services and make decisions. As automated systems take over more routine tasks, privacy compliance will become increasingly complex.

Businesses should use these changes as an opportunity to take control of their data-handling practices. Doing so can strengthen customer trust, improve operational efficiency and reduce the cost and disruption of correcting outdated privacy practices later.

For advice specific to your circumstances, consult a qualified Australian legal practitioner.