Privacy Act, from 10 December 2026
Automated decision-making disclosure builder
From 10 December 2026, privacy policies must say which decisions are made or shaped by computer programs, and what personal information those programs use. That includes AI, chatbots, recruitment platforms, credit engines and scoring spreadsheets, and it applies even when a person makes the final call. Three steps, about ten minutes, no account needed.
Prefer to read first? The full guide to the obligation.
General information only
This builder restates the statutory text of Australian Privacy Principles 1.7 to 1.9 and the examples in the OAIC's May 2026 issues paper. It is not legal advice, and its output is a draft for your privacy adviser to review, not a determination of your obligations. The OAIC has said it will publish guidance before commencement; revisit your draft when it does. Your answers stay in your browser unless you choose to email the draft to yourself.
What the law actually asks for
APP 1.7 sets a three-limb test for each computer program. When all three are met, APP 1.8 requires three lists in your privacy policy. That is the whole obligation, and it is what the builder walks through.
Limb a: the program’s role
You have arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making it. “Computer program” is deliberately broad: rule-based logic, machine learning, generative AI and chatbots all count. Calculating an age from a date of birth is directly related but not substantially, so it is out.
Limb b: significant effect
The decision could reasonably be expected to significantly affect the rights or interests of an individual, whether adversely or beneficially. Refusing or failing to decide counts. Eligibility, pricing, employment, credit, insurance, housing, education and health access are the classic examples; targeted content that changes prices or limits opportunities can qualify too.
Limb c: personal information
Personal information about the individual is used in the operation of the program to make the decision or do the related thing. Meet all three limbs and your privacy policy must list the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially assists.
10 December 2026
Obligation commences for every APP entity
May to June 2026
OAIC consulted on its issues paper; guidance to follow
APP 1
Sits inside the duty to keep a clear, up-to-date privacy policy
The builder
Your answers are saved in this browser only, so you can come back to them. Nothing is sent anywhere unless you ask for the draft by email.
Step 1
Does the Privacy Act cover your organisation?
The obligation applies to APP entities. Tick everything that describes you.
Step 2
List the programs that make or help make decisions about people
AI or not: recruitment platforms, CRMs, credit or fraud engines, chatbots, scoring spreadsheets, case-management rules. Add one card per system. The three questions are the three limbs of APP 1.7.
1.New system
System or tool
What it is used for
a. What does the program do in relation to decisions about individuals?
Step 3
Build the draft
Organisation name (optional)
Answer the questions on every system card first.
How the regulator draws the line
Worked examples from the Explanatory Memorandum and the OAIC's issues paper. Use them to calibrate your own answers.
Spreadsheet triage: in
A pre-programmed Excel formula scores and triages callers to a crisis hotline, and the score is a key factor in a human deciding the order of attendance. Substantially and directly related. In scope.
Spreadsheet arithmetic: out
The same spreadsheet is used only to work out an age from a date of birth, or to add up figures. Directly related to a decision, but not substantially. Out of scope.
Third-party tools you arranged: in
Procuring an AI system to screen and rank job applications; permitting staff to use an AI chat tool to draft performance assessments that determine promotions; contracting a provider to approve or decline refunds automatically; a case-management system that automatically escalates complaints. The entity that arranged the use carries the obligation.
Merely operating a system: not yours
Developing and hosting software that approves or rejects customer applications for other businesses, or maintaining the infrastructure of a fraud system, without using it to decide anything yourself. The obligation sits with the business that arranged the use, so keep clear records of who that is.
Common questions
A person makes the final decision. Are we outside the obligation?
No. APP 1.7 also covers a computer program that does a thing substantially and directly related to making a decision. The Explanatory Memorandum describes “substantially” as being a key factor in facilitating the human decision and “directly” as having a direct connection with it. A scoring, ranking or triage tool whose output a person relies on is covered even though the person decides.
We only use off-the-shelf tools. Does that count?
If you arranged for the tool to make, or substantially assist, significant decisions using personal information, yes. The OAIC’s examples include procuring an AI system to screen and rank job applications, permitting staff to use an AI chat tool to draft performance assessments that determine promotions, and contracting a provider to approve or decline refunds automatically. The obligation sits with the entity that arranged the use, not the vendor that operates the software.
Our turnover is under $3 million. Does this apply to us?
The obligation applies to APP entities. Most businesses with turnover of $3 million or less are exempt unless a specific trigger applies, such as providing a health service, trading in personal information or holding an Australian Government contract. The government has said it intends to remove the small business exemption in a later tranche of reforms, which had not been introduced to Parliament as at September 2026. Customers, tenders and certification already expect this transparency regardless.
Do we have to explain how the algorithm works?
No. APP 1.8 asks for the kinds of personal information used and the kinds of decisions made or assisted. The Explanatory Memorandum confirms that commercial-in-confidence information about the systems is excluded, and the OAIC describes the aim as enough meaningful information for people to understand the use of automated decision-making without excessive detail.
What happens if our privacy policy does not include this by 10 December 2026?
The requirement sits inside APP 1, the obligation to have a clearly expressed and up-to-date privacy policy. The 2024 reforms gave the OAIC infringement notice and compliance notice powers that reach privacy policy failures, alongside its civil penalty powers. Treat the date as a hard deadline.
When will the OAIC publish its guidance?
The OAIC consulted on an issues paper between May and June 2026 and said it would publish guidance ahead of commencement. This builder restates the statutory text, which does not change with the guidance. Tick the box in step 3 and we will email you once when the guidance is released.
Where certification fits
The disclosure tells people what your systems decide. Certification shows them how you govern those systems: accountability, fairness, human oversight and a way to contest decisions, assessed against the Australian AI Ethics Principles. Every certified business answers the automated decision-making questions as part of its application, and its public profile on the register shows how it uses AI.
Responsible AI Australia is a certification body, not a law firm or a regulator. Certification is not a determination of Privacy Act compliance and does not substitute for advice.