Most businesses will read "automated decision-making" and think of chatbots. The OAIC says simple formulas and scoring tools you've run for years can count. If a spreadsheet ranks your loan applicants, it's in.
What does APP 1.7 require?
Three new clauses in Australian Privacy Principle 1, added by the Privacy and Other Legislation Amendment Act 2024, apply when all three of these are true:
- You've arranged for a computer program to make a decision, or to do something substantially and directly related to making it.
- The decision could reasonably be expected to significantly affect someone's rights or interests.
- The program uses that person's personal information.
The rule applies to every decision made from 10 December 2026, including decisions made by tools you set up years ago.
Does it apply to my business?
Only if the Privacy Act covers you. Most businesses turning over $3 million a year or less are exempt. That exemption disappears for health service providers, businesses that trade in personal information, Commonwealth contractors and credit reporting bodies, whatever their size. The OAIC's small business page has the full list.
A person signing off on the result won't get you out of it. The OAIC's issues paper says a program that recommends, scores or sorts people still counts when its output is a key factor in the human's decision.
Which decisions count?
The Act gives three examples: granting or refusing a benefit under a law, a decision that affects someone's rights under a contract, and a decision that affects their access to a significant service.
In practice, look hard at:
- software that scores loan, finance or insurance applications;
- recruitment tools that screen or rank candidates;
- tenant screening in property management systems;
- booking rules that decide who gets seen first.
AI that drafts your emails or summarises meetings doesn't decide anything about a person, so it sits outside the rule.
What must the privacy policy say?
APP 1.8 asks for three things, in general terms:
- the kinds of personal information your programs use;
- the kinds of decisions a program makes on its own;
- the kinds of decisions a program substantially helps with, such as scoring or ranking.
General descriptions are enough, at the level of "your income and credit history" and "finance applications".
Privacy policy wording you can copy
Automated decisions
We use computer programs, including AI tools, in some decisions about you. When you apply for [finance], our assessment software uses [your income, expenses and credit history] to score your application, and a member of our team uses that score to decide. Our booking system uses [the reason for your visit] to decide [how soon we can see you]. To ask about a decision we made about you, contact [privacy officer, email].
Swap the brackets for what your tools do. If a program decides with nobody reviewing it, say so.
Your checklist before 10 December
- List every tool that touches a decision about a customer, applicant, tenant or employee, including features inside software you already pay for.
- Run each one through the three tests above.
- Write down the personal information each in-scope tool uses.
- Add an automated decisions section to your privacy policy.
- Brief the staff who answer customer questions.
What happens if you get it wrong?
The OAIC can already fine a company up to $21,840 per contravention, by infringement notice, for a privacy policy that isn't clearly expressed and up to date. The OAIC says it will expand its guidance on the new clauses.
Run the free AI privacy and compliance check to see where you stand, or book a 15-minute call and we'll go through your tools with you.
Frequently asked questions
When does the automated decision-making rule start?
10 December 2026. It applies to decisions made from that date, including by tools set up earlier.
Does it only apply to AI?
No. Any computer program counts, including simple formulas and scoring rules.
If a staff member makes the final call, do I still need to disclose it?
Yes, when the program's recommendation or score is a key factor in that person's decision.
Are small businesses exempt?
Most businesses with turnover of $3 million or less are outside the Privacy Act. Health service providers and several other types are covered at any size.
Do I have to explain how my AI model works?
No. You describe the kinds of personal information used and the kinds of decisions made, in general terms.