What changes on 10 December 2026?
Amendments made by the Privacy and Other Legislation Amendment Act 2024 add APP 1.7 to 1.9 to the Australian Privacy Principles. From 10 December 2026, an APP entity must add specific information to its APP privacy policy when three conditions are met: it has arranged for a computer program to make a decision, or to do something substantially and directly related to making it; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about that individual is used in the program's operation. The OAIC published a fact sheet and version 2.0 of its APP 1 guidelines in September 2026 to explain how it reads each condition.
Does the rule apply to your business?
The obligation applies to APP entities: Australian Government agencies and the organisations the Privacy Act 1988 covers. According to the OAIC, most small businesses with an annual turnover of $3 million or less are not covered, and turnover for this purpose counts income from all sources. Some small businesses are covered regardless of turnover, so check the list below before assuming you are exempt. A business covered for any of these reasons must meet APP 1 in full, including the new wording about automated decisions.
- A health service provider.
- A business that trades in personal information.
- A contractor providing services under a Commonwealth contract.
- A credit reporting body or an operator of a residential tenancy database.
- A reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
What counts as a computer program and a decision?
The OAIC reads computer program broadly. Its fact sheet lists pre-programmed rule-based processes, AI and machine learning, ordinary software, apps and word-processing tools, and generative AI that produces text, images, video or code, including chatbots. A decision includes choosing to act or not act, doing or refusing to do something, and outcomes that could benefit or disadvantage a person. APP 1.9 confirms that refusing or failing to make a decision counts. In the OAIC's own example, a care provider's spreadsheet formula that ranks clients for follow-up is in scope, and it stays in scope if staff use the ranking to decide whom not to contact.
Does human review take a decision out of scope?
Often it does not. A program is substantially and directly related to a decision when its output is a key factor with a direct connection to the decision a person makes. The OAIC says this applies whether the output is advisory or determinative, and that machine learning or generative AI outputs used in significant decisions would generally be in scope unless they are subject to extensive human oversight and control. You are also treated as having arranged for a program when you buy third-party software, configure an off-the-shelf product or rely on its advisory outputs, so using a vendor's tool does not move the obligation to the vendor.
A practical internal test: if staff rarely change the program's recommendation, or would need to justify departing from it, treat the program as substantially and directly related to the decision until a qualified adviser tells you otherwise.
Which decisions significantly affect someone?
Significant means more than trivial, with the potential to considerably influence a person's circumstances or outcomes. A right is a moral or legal entitlement to have or do something, and an interest is a concern, benefit or stake. The OAIC adds that vulnerability matters, because the same decision can weigh more heavily on people experiencing vulnerability. Its fact sheet gives a non-exhaustive list of decisions it would generally treat as in scope. Several of them apply to ordinary businesses as well as to government and finance.
- Recruitment software that sorts candidate profiles and informs hiring decisions.
- AI-generated reports used to rank employee performance or decide promotions, bonuses or pay.
- Approving or rejecting a loan or credit application, or assessing eligibility for insurance.
- Personalised or differential pricing by online retailers selling significant goods.
- Programs that prioritise access to health or disability services.
- Decisions about admission to education or training, scholarships or grants.
What must the privacy policy say?
APP 1.8 requires three items: the kinds of personal information used in the operation of the programs, the kinds of decisions made solely by the programs, and the kinds of decisions where a program does something substantially and directly related to making them. You may group decisions and information types into categories, but the result must be meaningful to a reasonable person, and the use of sensitive information such as health information or biometric templates should be clear. Commercially sensitive information and trade secrets are excluded, though the OAIC notes that information which would only cause embarrassment or public criticism does not fall within that exclusion.
How can you prepare before 10 December?
Most of the work is finding the decisions, which sit in HR, finance, customer service and marketing tools as often as in anything labelled AI. Work through the steps below, record what you find and give the draft wording to whoever approves your privacy policy. Where a vendor's product is involved, the OAIC expects providers to give their customers clear, high-level information about how the software can be used to make decisions, so ask your vendors for it in writing.
- List every system that scores, ranks, filters, approves, declines or prices something about an individual, including spreadsheets with formulas.
- For each one, record the personal information it uses and the decision it makes or informs.
- Note whether a person decides using the output, or the program decides alone.
- Assess whether the decision could significantly affect the individual, noting any vulnerable groups.
- Draft grouped privacy policy wording for the in-scope decisions and have it reviewed.
- Add each in-scope system to your AI register so new tools are checked before they go live.