01What does the Privacy Act's automated decision making rule require?
From 10 December 2026, an organisation covered by the Privacy Act must say in its privacy policy when a computer program makes, or substantially and directly helps make, a decision that could significantly affect a person's rights or interests, using their personal information.
The rule is new APP 1.7 to 1.9, added to the Privacy Act 1988 by the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024. It is a transparency rule, and APP 1.7 sets the trigger above. The other two provisions fill it out:
- APP 1.8 sets the content: the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions a program substantially and directly informs.
- APP 1.9 widens the meaning. Refusing or failing to decide counts as deciding, an effect can be beneficial or adverse, and affected rights include a benefit granted under law, rights under a contract and access to a significant service or support.
The Act applies the rule to decisions made after the start date, whenever the program was set up or the personal information collected. A credit decisioning engine configured in 2019 is in scope for every decision it makes from 10 December, so ADM disclosure in Australia starts with programs already running.
02Which decisions and tools does the OAIC guidance put in scope?
The OAIC's guidance puts in scope any computer program that makes or materially shapes a significant decision about a person, from AI models to rules engines and spreadsheets, including where a person reviews the output.
The OAIC published its final guidance on 30 September 2026: an updated chapter 1 of the APP guidelines (version 2.0), a fact sheet and a flowchart. Its key interpretations:
- "Computer program" takes its ordinary meaning. It includes rule-based processes, AI and machine learning, and commonly used software and apps. The fact sheet's first worked example is a spreadsheet, and the OAIC treats its use as a decision within scope.
- Human review does not take a decision out of scope. A decision can be in scope where the program's output is subject to human review, and the output can be advisory or determinative.
- "Substantially" means a key factor in the decision; "directly" means a direct connection to it. The OAIC weighs how much the decision-maker relies on the output, whether they can override it and how deeply it sits in the workflow.
- "Significantly" means more than trivial, with the potential to considerably influence a person's circumstances. Examples include insurance contracts, access to healthcare, housing and employment, and personalised pricing for significant services. The effect on a vulnerable person can make a decision significant.
- Using a program only to record a decision is out of scope, such as typing up a decision letter.
Where an organisation is unsure, the fact sheet advises a cautious approach: include the decision in the privacy policy.
A four-question decision test for each candidate decision:
- Does a computer program of any kind make the decision, or produce something the decision-maker relies on as a key factor?
- Could the decision considerably influence a person's rights, circumstances or access to a significant service, for better or worse?
- Is personal information about that person used when the program runs?
- Is it a decision made from 10 December 2026, whenever the program was built?
Four yeses put the decision in scope. Treat a doubtful answer as a yes until privacy and legal rule on it.
03What must a privacy policy say about automated decisions?
A privacy policy must describe three things about automated decisions: the kinds of personal information the programs use, the kinds of decisions made solely by programs, and the kinds of decisions where a program substantially and directly informs a person who decides.
The OAIC asks for information meaningful to a reasonable person. Decisions can be grouped by category, framed so a person can understand and contest the decision, and should say clearly where sensitive information is used.
A worked example (an illustration): a regional bank. Its inventory finds 14 in-scope decisions. They group into four kinds, two made solely by a program and two where a program substantially informs a person:
- Made solely by a program: declining card transactions flagged as likely fraud; setting a variable interest rate offer at origination within an approved range.
- A program substantially informs a person: home loan approvals, where a credit score and serviceability engine produce a recommendation a credit assessor confirms; hardship assessments, where a rules tool proposes a repayment arrangement.
For each kind, the policy names the personal information used (identity, income and expenses, account conduct, credit reporting information, device data) and how customers can ask for more detail.
04How do you build an automated decision inventory?
An automated decision inventory starts with the decisions an organisation makes about people, then traces each one to the programs, data and people behind it.
A list of systems misses spreadsheets, rules inside workflow tools and vendor scores. Six steps work in practice:
- List the decisions that affect people. Walk each customer, member and employee journey: onboarding, credit, pricing, claims, fraud blocks, hardship and recruitment screening.
- Trace each decision to its programs. Find what produces or shapes it: platform rules, decision engines, models, vendor scores, spreadsheets and AI tools staff use to draft assessments.
- Record six fields for each. See the table below.
- Apply the four-question test. Mark each decision in scope, out of scope or doubtful, and send doubtful ones to privacy and legal for a ruling.
- Group the in-scope decisions into kinds. These become the privacy policy wording.
- Put the inventory under change control. Any new model, rule or vendor tool touching a listed decision updates it before go-live.
| Field | What to record |
|---|---|
| Decision and owner | The decision in plain words, and the executive accountable for it |
| Program | Every program that makes or shapes it, including vendor tools and spreadsheets |
| Personal information used | The kinds of data, flagging sensitive information |
| Effect on the person | What changes for them, and whether vulnerable people are affected |
| Human role | Who reviews or overrides the output, how often they do, and with what information |
| Classification | Solely automated, substantially informed, or out of scope, with the reason |
A worked example (an illustration): a large super fund. Insurance claims triage is the obvious candidate. The sweep also finds a spreadsheet the administration team uses to calculate some exit benefits, and a rules engine that pauses member requests on suspected fraud. Both affect members' access to their money, so both enter the inventory.
05What should a board ask to see before 10 December?
Before 10 December, a board should see evidence that management has found every in-scope decision, named an owner for each, and updated the privacy policy to match.
Five things to ask for:
- The inventory and its coverage: counts of in-scope, out-of-scope and doubtful decisions, and which journeys, vendors and spreadsheets the sweep covered.
- The doubtful decisions and how they were ruled, with the reason for each exclusion.
- The draft privacy policy wording, mapped back to the inventory.
- The owners: a named executive for every in-scope decision, and the process when someone asks how a decision about them was made.
- The plan to keep it current: how new models, vendor tools and rule changes reach the inventory before go-live.
A useful board test: pick one customer decision and ask management to walk through its inventory entry, the human role and the policy wording.
06How does automated decision disclosure connect to AI governance and APRA's expectations?
Automated decision disclosure draws on the same inventory, owners and controls AI governance needs, so the work serves both.
On 30 April 2026 APRA wrote to banks, insurers and super trustees about AI. It found that many boards lack the technical literacy to challenge management on AI risks, that some entities depend heavily on a single provider for multiple AI use cases, and that assurance is often fragmented. APRA added no new requirements and expects entities to close the gaps under the prudential standards they already follow. CPS 230 Operational Risk Management, in force since 1 July 2025, covers operational risk, critical operations and material service providers, which can include the providers behind an AI system.
For an APRA-regulated entity, the automated decision inventory is a large part of an AI inventory. Add a risk rating, the supplier, monitoring and the threshold above which a person decides, and one register supports the privacy policy, the conversation with APRA and the board's oversight of AI.
Explore AI governance consulting →
07What should an organisation do in the weeks before 10 December?
In the weeks before 10 December, sweep the decisions, settle the doubtful cases, publish the policy update, and plan the fuller inventory for 2027.
- Week 1: sweep. Walk the decisions with each business line and HR, and ask every team for the spreadsheets and tools they use to decide anything about a person.
- Week 2: classify. Apply the four-question test, record the six fields and send doubtful decisions for a ruling.
- Week 3: draft and approve. Group decisions into kinds, draft the policy wording, and take it to the executive and board committee.
- Before 10 December: publish. Update the privacy policy and brief frontline and complaints teams.
- After 10 December: harden. Put the inventory under change control, extend it into the AI inventory, and test one decision each quarter.
The AI Maturity Assessment scores your organisation's governance, risk and compliance alongside four other dimensions in 5 minutes, and shows where to focus first.
Take the AI Maturity Assessment →
This article is general information about the Privacy Act and the OAIC's guidance. It is not legal advice; confirm how the rules apply to your organisation with your legal and privacy advisers.
Notes and sources
- APP 1.7 to 1.9 text, Royal Assent on 10 December 2024, and application to decisions made after commencement whenever the arrangement was made or the information collected (Schedule 1, Part 15, item 89): Privacy and Other Legislation Amendment Act 2024, Federal Register of Legislation
- Start date of 10 December 2026; meaning of computer program, substantially, directly and significantly; human review; advisory outputs; examples; vulnerability; level of detail in the policy: OAIC, APP guidelines chapter 1, version 2.0, updated 30 September 2026
- Spreadsheet worked example; "take a cautious approach": OAIC, APP 1.7 to 1.9 Transparency Obligation fact sheet, September 2026
- Release of the final guidance, fact sheet and flowchart: OAIC media release, "New resources on transparency for use of AI and automated decision-making", 30 September 2026
- APRA's letter to industry on AI, 30 April 2026; findings on board literacy, single-provider dependence and fragmented assurance, and "not proposing to introduce additional requirements at this stage": APRA media release, 30 April 2026
- CPS 230 Operational Risk Management, in force from 1 July 2025: APRA