From 10 December 2026, organisations covered by the Privacy Act 1988 (Cth) must explain in their privacy policies their use of personal information in certain automated decisions. The change comes from new Australian Privacy Principles 1.7 to 1.9, introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth).
When does it apply?
It applies where:
- you have arranged for a computer program to make a decision, or to do something substantially and directly related to making one;
- the decision could reasonably be expected to significantly affect an individual’s rights or interests; and
- the program uses personal information about that individual.
This is not only about AI. “Computer program” is broad, and rule-based software, scoring tools and even spreadsheets can be caught. Human review of the output will not necessarily take a decision outside the rules.
Think recruitment screening, credit decisions, personalised pricing of significant goods or services, fraud and scam detection that can block access to an account or service, account suspensions and automatic cancellations.
What must your privacy policy say?
Your policy must describe:
- the kinds of personal information used;
- the kinds of decisions made solely by the program; and
- the kinds of decisions for which the program does something substantially and directly related to making the decision.
The OAIC’s final guidance (30 September 2026) does not require technical detail. It prefers decisions with different outcomes to be described separately, and expects health information and other more sensitive information, such as biometric data, to be called out clearly. Where it is unclear whether a use is caught, the OAIC recommends a cautious approach of including it in the policy.
The rules apply to decisions made from 10 December 2026, even if the system was set up or the personal information collected, before then. The obligation sits with the business that arranges for the program to be used in its decisions, which will usually be the business using the software rather than the supplier and a supplier contract will not shift that responsibility.
Who is affected?
Commonwealth agencies and organisations (including not-for-profits) with annual turnover above $3 million, plus some smaller businesses, including health service providers. These changes do not affect the small business exemption, which remains in place.
What should you do now?
In our view, many businesses will have more to disclose than they expect. Map the automated tools you use, including those built into third-party software, test each against the three criteria and update your privacy policy before 10 December 2026. Record your assessments, including for tools you decide fall outside the rules.
Please get in touch to discuss how these changes apply to your business.
This article is general commentary only and does not constitute legal advice.
Principal Lawyer | Head of Commercial and Corporate
KCL Law
jgoldman@kcllaw.com.au | 03 8600 8888