What the Privacy Act’s new automated decision-making transparency obligations mean for your organisation – and how to be ready from 10 December 2026
From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policies when computer programs make, or substantially help to make, decisions that significantly affect people. The disclosure itself may be only a few paragraphs long. Knowing what it must say, and being able to stand behind it, is the real work.
Automated Decisions Are Moving Into the Privacy Policy
Algorithms, business rules and AI tools now shape decisions that matter in people’s lives: whether a loan is approved, how a claim is triaged, which job applicants are shortlisted, what price a customer is offered and who is seen first. Until now, Australian privacy law has said little about how organisations explain that automation to the people it affects.
That changes on 10 December 2026. The Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024, inserted new Australian Privacy Principles (APPs) 1.7 to 1.9 into the Privacy Act 1988 (Cth) with a two-year lead time. From commencement, an organisation’s APP privacy policy must describe how it uses personal information in certain kinds of automated decision-making (ADM). The obligation applies to decisions made from that date, even where the system was built, or the personal information collected, beforehand.
The obligation applies to APP entities: Australian Government agencies and most private sector organisations with an annual turnover above $3 million, as well as some smaller businesses, such as health service providers. Figure 1 shows how the reform has unfolded and what comes next.
Figure 1. Key milestones in the automated decision-making transparency reforms
Three Questions Decide Whether a Decision Must Be Disclosed
APP 1.7 applies when three conditions are all met (Figure 2). First, the organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making it. Second, the decision could reasonably be expected to affect an individual’s rights or interests significantly. Third, the program uses personal information about that individual.
APP 1.9 adds that making a decision includes refusing or failing to make one, and that a decision can affect an individual’s rights or interests beneficially or adversely. The provisions give examples of decisions that may have that effect: granting or refusing a benefit under legislation, decisions affecting rights under a contract, agreement or arrangement, and decisions affecting access to a significant service or support.
Where all three conditions are met, APP 1.8 requires the privacy policy to set out the kinds of personal information used by those programs, the kinds of decisions made solely by them, and the kinds of decisions where a program does something substantially and directly related to making the decision.
Figure 2. The APP 1.7 test and what APP 1.8 requires a privacy policy to disclose
The Regulator Has Drawn the Net Wide
The Office of the Australian Information Commissioner (OAIC) consulted on its approach through an Issues Paper in May 2026 and published final guidance on 30 September 2026: updated APP 1 Guidelines, a fact sheet, a scope-assessment flowchart and supplementary guidance for government agencies. Four themes stand out for organisations that assumed the new rules were only about artificial intelligence. Figure 3 shows where in-scope decision points commonly sit.
Figure 3. Common decision points that warrant an APP 1.7 assessment
‘Computer program’ covers almost any software. The OAIC’s interpretation extends to rule-based tools, AI and machine learning, generative AI and chatbots, and everyday software, including spreadsheets. A long-standing spreadsheet formula can be captured as readily as a new model.
Human sign-off is not an exit. A program can be in scope when its output is a key factor directly connected to the decision, whether it advises or determines. The OAIC weighs how much staff rely on the output, how likely they are to override it, whether it is advisory or determinative, whether it can be explained, and how deeply it is integrated into the process.
Buying a tool means owning the disclosure. The obligation sits with the organisation that uses the technology, not its vendors. An organisation has ‘arranged for’ a program if it procures, configures, authorises, integrates or relies on it, even if a supplier operates it. That calls for information from suppliers about how embedded decision features work, and contracts that make clear who is making each decision.
‘Significant’ sets a modest bar. The OAIC treats ‘significantly’ as meaning more than trivial, and asks organisations to consider whether outcomes would differ materially for people experiencing vulnerability. Targeted employment advertising is expressly in scope, and personalised or differential pricing may be. In one OAIC example, a cumulative price difference of 89 cents on essential goods such as baby formula may be significant.
For government agencies, the OAIC considers most automated administrative decisions likely to affect individuals significantly, and has indicated that a high-level AI transparency statement is unlikely, on its own, to satisfy APP 1. Agency privacy policies should identify decision types, such as eligibility for support payments, and the personal information involved.
A Short Disclosure Still Has To Say Something Meaningful
The disclosure is not meant to be technical. The OAIC’s guidance indicates that decisions can be grouped into categories rather than listing every sub-step, as long as the categories remain meaningful to a reasonable person. Identify processes with different purposes, outcomes, or data separately, and call out more sensitive information, such as biometric or health information, clearly. The exclusion for commercial-in-confidence information is narrow: it covers information whose disclosure would genuinely harm commercial interests, not information that is merely valuable or potentially embarrassing.
Figure 4. Illustrative contrast between a generic and a meaningful ADM disclosure
A single sentence saying an organisation ‘may use automated processes’ tells individuals almost nothing (Figure 4). A meaningful disclosure names the kinds of decisions, the personal information they draw on, and whether a program decides alone or assists a person.
The regime prioritises transparency over control. Unlike the European Union’s General Data Protection Regulation, it does not give individuals a right to contest an automated decision or request an explanation, and it does not require organisations to notify individuals directly. Once a disclosure is public, however, customers, advocates, journalists and the regulator can test it against how the organisation actually operates.
The Privacy Policy Is Only the Visible Tip of the Work
It is tempting to treat 10 December as a drafting exercise for the legal team. In practice, no one can write an accurate disclosure without first knowing where automation sits in the organisation’s decisions, and in most organisations no single person knows. Decision logic lives in core platforms, software-as-a-service products, vendor-managed services, analytics models, business rules and spreadsheets owned by individual teams.
Figure 5. What sits beneath an accurate APP 1.8 disclosure
Figure 5 shows what sits beneath a defensible disclosure. Each layer is a body of work: finding every program that makes or shapes a significant decision; documenting why each is in or out of scope; evidencing how people actually use system outputs; tracing which personal information feeds which decision; obtaining information from suppliers; and setting triggers so the policy stays current as systems change. Table 1 shows how that work lands across the organisation.
Table 1. How the obligation lands across the organisation
Enforcement is no longer theoretical
The OAIC has new tools and has shown it is prepared to use them. In January 2026 it began its first privacy compliance sweep, reviewing the privacy policies of about 60 organisations across six sectors against APP 1. The 2024 reforms also allow the OAIC to issue compliance notices and infringement notices for certain privacy-policy failures without going to court, and introduced a mid-tier civil penalty for less serious interferences with privacy (Table 2).
Table 2. The enforcement toolkit behind APP 1
Dollar amounts reflect the Commonwealth penalty unit of $364 for contraventions on or after 1 July 2026. Which tool applies depends on the facts; this is a general summary, not legal advice.
A Two-Speed Response Gets You Compliant and Keeps You Compliant
With commencement close, most organisations need to work on two horizons at once (Table 3): a prioritised, defensible position for 10 December, and a sustainable capability that keeps the disclosure accurate.
Table 3. A two-speed response
December 10 Is a Starting Line, Not the Finish
APP 1.3 requires a privacy policy to be kept up to date. Every new system, model, rule change, or supplier after 10 December 2026 is a potential change to what the policy must say, so the capability to assess and disclose automated decisions must become part of business as usual.
More reform is coming. On 31 August 2026, the Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, the second tranche of Privacy Act reform. It contains around 40 proposals, including a ‘fair and reasonable’ test for collecting, using and disclosing personal information, a broader definition of personal information, a formal distinction between controllers and processors, and 72-hour notification of eligible data breaches. Consultation closed on 18 September 2026, and the Government has said it intends to introduce legislation before the end of 2026. The draft may change, but the direction is clear: organisations will need to justify how they use personal information, and automated decisions are a natural place for that scrutiny to start. The decision inventory built for APP 1.7 underpins that work.
Commonwealth agencies have a further thread to watch. A private member’s bill introduced on 7 September 2026, the Automated Decision-Making (Safeguards and Transparency) Bill 2026, proposes a mandatory framework for automation in Government in response to the Robodebt Royal Commission’s recommendations, and the Attorney-General’s Department has been developing a whole-of-government framework following public consultation in late 2024 and early 2025.
CTO Consulting Brings Regulatory Discipline to Automated Decisions
CTO Consulting helps Australian government and enterprise organisations turn regulatory obligations into practical, evidenced controls. Our consultants combine business analysis, enterprise architecture, ICT policy and technology governance expertise with experience across Government, financial services, health, retail, telecommunications and utilities. We have built ICT policy frameworks and requirements registers that trace obligations through to policies, controls and evidence, and we apply the same discipline to automated decision-making.
Our approach follows the method we use for every regulatory obligation: map, assess, design, then embed and prove (Figure 6).
Figure 6. CTO Consulting’s regulatory compliance method, applied to automated decision-making
Map. We run decision-discovery workshops with business owners, inventory systems, vendor tools, models and spreadsheets, and map decision journeys and data flows to build a draft ADM decision register.
Assess. We test each decision against the three-limb test, examine how staff actually rely on system outputs, consider the effect on people experiencing vulnerability, and compare the results with your current privacy policy.
Design. We prepare plain-language disclosure inputs for your legal advisers, grouped by decision type, together with supplier information requests, contract clauses and a governance model with clear ownership and review triggers.
Embed and prove. We build ADM assessment into project, procurement, and change processes, train decision owners and front-line teams, and assemble the evidence showing how each disclosure was reached.
We work alongside your legal and privacy advisers. They settle the legal interpretation and the final wording; we provide the evidence base, analysis and operating rhythm that make the disclosure accurate and keep it that way. Our human-centred design practice helps make disclosures understandable to the people they affect, and our technology and vendor selection experience helps put supplier arrangements on a sound footing.
Table 4. Ways to engage with CTO Consulting
The Organisations That Know Their Decisions Will Be Ready
The new obligations are short on paper but long in practice. Organisations that treat them as a one-off wording change risk publishing disclosures they cannot defend. Those that use them to build a living picture of how they make decisions will be better placed for the regulator, for Tranche 2, and for the trust of the people their decisions affect.
To arrange an ADM readiness conversation, contact CTO Consulting.
By Karim Khalifa, CTO Consulting
Business Analysis Practice Lead
Karim is a Business Analysis Practice Lead, project manager, and process engineer, specialising in complex enterprise transformation. He works across financial services, telecommunications, retail, and government, managing requirements, aligning stakeholders, strengthening governance, and delivering measurable outcomes in multi-vendor environments. Karim has a special interest in artificial intelligence, regulatory compliance and business benefits realisation.
This article provides general information only and is not legal advice. Organisations should obtain legal advice about how the Privacy Act applies to their circumstances. Information is current as at November 2026.
Sources
1. Privacy Act 1988 (Cth), Schedule 1, APPs 1.3–1.9, as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth)
2. OAIC, Australian Privacy Principles Guidelines, Chapter 1: APP 1 (updated 30 September 2026)
3. OAIC, New resources on transparency for use of AI and automated decision-making (30 September 2026)
4. OAIC, Automated Decision-Making Transparency Obligation (APP 1) Issues Paper (18 May 2026)
5. OAIC, Privacy compliance sweep to put privacy policies under the spotlight (December 2025)