Automated decision-making and privacy: what organisations need to do before 10 December 2026

With the deadline of 10 December 2026 looming, entities required to comply with the Australian Privacy Principles (APP entities) must update their privacy policies if they arrange for a computer program to use personal information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests.

In practice, applying this multi-limbed test can be complex. It requires careful assessment of the relevant decision, the personal information used and the role played by the computer program. The Office of the Australian Information Commissioner (OAIC) has now released guidance on the new requirements and how APP entities should implement these obligations (OAIC Guidance).

Our earlier Australian Privacy Law Update explains the reforms in detail. In this article we focus on the practical work that organisations should be completing now.

At a glance

Organisations should start by identifying all decisions made with the help of computer programs (often referred to as automated decision-making, or ADM). Importantly, this exercise is broader than reviewing an organisation's use of AI. The requirements capture a wide range of technology, from automated workflows, software and apps through to more traditional tools such as spreadsheets that apply decision-making formulas. It is also worth noting that human involvement in the decision-making process will not necessarily take that process out of scope.

When does APP 1.7 apply?

All three limbs of the test must be satisfied for APP 1.7 to apply. The table below sets out the legal test alongside some practical guidance on each element.

What must the privacy policy say?

Where APP 1.7 applies, the privacy policy must describe:

• the kinds of personal information used by the relevant computer programs;
• the kinds of decisions made solely by those programs; and
• the kinds of decisions for which those programs do something substantially and directly related to making the decision.

Information may be grouped, but it must remain meaningful to a reasonable person. Organisations must strike a balance of avoiding unnecessary technical detail, while also ensuring that disclosures are not so generic as to be meaningless.

What should organisations focus on in the next four weeks?

With the commencement date fast approaching, organisations should prioritise the internal assessment needed to identify relevant decision-making processes and determine whether the APP 1.7 threshold is met. Updating the privacy policy should then follow, once that assessment is complete.

Conduct a targeted ADM review and assessment

• Map high-impact decisions and systems: For organisations that have yet to start, this will be the largest task, so it should begin as soon as possible. A sensible starting point is to identify decisions that may significantly affect individuals, and then the programs that make or materially assist those decisions. Priority areas may include recruitment, customer onboarding, credit, insurance, claims, fraud detection, healthcare, complaints, pricing and access to significant services. It is important that business units understand this is not an AI-only exercise; it should extend to embedded and third-party systems, as well as legacy rules-based tools and spreadsheets.
• Test and record each use case: For each process, organisations should record the categories of affected individuals, the personal information used, the program's output, the degree of human reliance on that output and the likelihood that a person will override or interrogate a computer-generated result. It is prudent to keep a record of all in-scope, borderline and out-of-scope assessments in an ADM register to demonstrate that the organisation has had due consideration to its transparency obligations.
• Close supplier gaps: Using a third-party platform does not necessarily transfer responsibility to the provider. Organisations will therefore need enough information to understand the system’s purpose, inputs, outputs, human review functions, limitations and any material changes. As a general rule going forward, procurement and renewal processes should require suppliers to provide the information needed for the APP 1.7 assessment and to notify the organisation of changes to the system, its information inputs or its decision-making functionality.

Prepare your privacy policy disclosure

Once the assessment is complete, organisations can prepare a clear and appropriately tailored disclosure. The disclosure should use plain language, distinguish solely automated from computer-assisted decisions where appropriate, identify sensitive information clearly and enable individuals to seek further information. While commercial-in-confidence information need not be disclosed, that exclusion should be applied narrowly.

In our experience, a short table describing the business activity, the kinds of decisions, the role of the program and the kinds of personal information used can be an effective format.

Keep your ADM register and privacy policy up to date

Organisations add new tools to their business processes all the time, so it is critical that privacy compliance is treated as an ongoing exercise. Organisations should put processes in place so that new uses of computer programs to assist decision-making are flagged and escalated for consideration, documented in the organisation's ADM register and, where necessary, disclosed in its privacy policy.

Next steps

With the 10 December deadline only weeks away, organisations that have not yet mapped their computer-assisted decision-making should begin that discovery work now. It is worth remembering that updating the privacy policy is the final step in the process, rather than the starting point.

Lander & Rogers can assist with a targeted ADM review, supplier information gaps and privacy policy updates. Our Privacy Policy Rapid Review Service offers proportionate options to help organisations prepare before commencement.

Please contact our privacy and AI team to discuss the approach that best fits your organisation.