From 10 December, privacy policies have to cover automated decisions

Businesses covered by the Privacy Act have until 10 December 2026 to add a new section to their privacy policy if they use a computer program to make, or help make, decisions that significantly affect people. The Office of the Australian Information Commissioner (OAIC) set out what's expected in a fact sheet, a flowchart and updated APP 1 guidelines published on 30 September.

The rule comes from the Privacy and Other Legislation Amendment Act 2024, which added it to Australian Privacy Principle 1. The OAIC says its guidance reflects 90 written submissions from academics, industry, government and others.

What the policy has to say

If the rule applies, the privacy policy has to list the kinds of personal information the program uses, the kinds of decisions the program makes on its own, and the kinds of decisions it does something substantially and directly related to.

The OAIC says you can group these into categories, but the detail has to be meaningful to a reasonable person. Where more sensitive information is involved, such as health information or face scans, that should be clear. Commercially sensitive information and trade secrets about how a program works don't have to go in.

Does it cover the tools I already use?

It might. The OAIC defines a computer program broadly. It includes pre-programmed rule-based processes, AI and machine learning, software, apps and word-processing tools, and generative AI, including chatbots.

The program doesn't have to make the whole decision. The OAIC says a decision can be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review". It also says generative AI outputs used in decisions that significantly affect people would generally be in scope unless there's extensive human oversight and control.

One of its worked examples is a spreadsheet with a formula that ranks clients for health and aged care appointments. Another is a manager using a generative AI tool to suggest staff bonuses and pay rises, with a director signing off each one. Both are in scope.

The OAIC's list of decisions that would generally count includes recruitment software that sorts candidates and helps make hiring decisions, AI reports used to rank staff performance or decide bonuses, personalised pricing by online retailers selling significant goods, and approving or rejecting a loan or credit application.

If you buy the software from someone else, the obligation still sits with you. The OAIC expects software vendors to give their customers clear, high-level information so they can write their policy.

Who has to do it

The rule applies to APP entities, the organisations the Privacy Act covers. The OAIC says most small businesses, those with an annual turnover of $3 million or less, aren't covered. Some are, whatever their turnover, including health service providers, businesses that trade in personal information and contractors providing services under a Commonwealth contract. The OAIC has a privacy checklist for small business to help you work out where you stand.

If you're covered, start by listing the tools that score, rank, approve or reject customers, patients, applicants or staff, and what information they use. If you're not sure whether something is in scope, the OAIC's advice is to take a cautious approach and include it in your privacy policy.