The short answer
From 10 December 2026, if your business uses a computer program to make, or substantially help make, decisions that could significantly affect people, and the program uses their personal information, your privacy policy must say so. It must name the kinds of personal information used and the kinds of decisions involved. To write that, you first need to know which programs you have.
On this page
Key takeaways
- The rule covers rules engines, scoring tools and vendor software, not just AI.
- A person reviewing the output does not automatically take a decision out of scope.
- Your privacy policy describes kinds of decisions and kinds of information, not your algorithms.
- The real work is the inventory. You cannot disclose what you have not found.
What changes on 10 December 2026?
The Privacy and Other Legislation Amendment Act 2024 added three new clauses to Australian Privacy Principle 1, APP 1.7 to 1.9. They start on 10 December 2026. From that date, any business covered by the Privacy Act that uses computer programs in decisions about people must explain this in its privacy policy.
The Office of the Australian Information Commissioner (OAIC) published updated APP 1 guidelines, a fact sheet and a flowchart on 30 September 2026. They read the rule broadly.
How do you know if a system counts?
A system is in scope when all three of these are true.
- A computer program makes the decision, or does something substantially and directly related to making it. This includes AI and machine learning, but also rules engines, scoring models, workflow tools and, on some readings, spreadsheets.
- The decision could reasonably be expected to significantly affect a person's rights or interests. Small conveniences do not count. Decisions about money, contracts, access to services or a person's livelihood usually do.
- Personal information about that person is used in running the program. If the program never touches information about the individual, the rule does not apply.
The OAIC guidance is clear that a decision can be in scope even when the program does not make the whole decision, or when a person reviews its output. If the program's output shapes what the person decides, assume it counts.
What counts as a significant effect?
The Act gives three examples of decisions that may affect a person's rights or interests:
- Granting or refusing a benefit under a law.
- Decisions that affect a person's rights under a contract, agreement or arrangement.
- Decisions that affect a person's access to a significant service or support.
In practice, regulated businesses should look closely at programs like these:
- Lending: credit scoring, serviceability calculators, automated declines, fraud flags that hold an application.
- Insurance: pricing models, underwriting rules, claims triage and fraud scoring.
- Hiring: tools that screen or rank job applicants.
- Health: triage tools and systems that prioritise appointments or referrals.
- Professional services: client onboarding and identity checks that can refuse or delay service.
For lenders and brokers
Credit decisions are the textbook case. If a program scores, ranks, declines or routes applications, it almost certainly counts, whether you built it or it sits inside your loan origination system or aggregator platform. Expect your bank and aggregator partners to ask what you have disclosed.
What must your privacy policy say?
Where a program meets the test, your privacy policy must describe:
- The kinds of personal information used in running those programs.
- The kinds of decisions made solely by a program.
- The kinds of decisions where a program does something substantially and directly related to the decision.
You do not have to publish how your models work, and commercial-in-confidence information about the systems is excluded. But the description has to be specific enough for a reader to understand which decisions involve software.
Who does it apply to?
Every APP entity: Australian Government agencies, and businesses with annual turnover above $3 million. Smaller businesses are usually exempt, but some are covered whatever their size, such as health service providers. Check your position with your legal adviser.
It applies to systems you already run, not just new ones, and to software you buy as well as software you build. If you arranged for a vendor's program to make or shape the decision, it is your disclosure to make.
What should you do before 10 December?
- List every program that touches decisions about people. Include AI features switched on inside software you already pay for, vendor scoring tools and the spreadsheets your team relies on. This is your AI register.
- Run each one through the three-part test. Write down the answer and the reasoning for each part. If a regulator or customer asks, the reasoning is your evidence.
- Group the ones that count into kinds of decisions. The policy describes kinds, not individual systems. "Decisions about whether to approve a loan application" is the right level.
- Update your privacy policy with your legal adviser. Name the kinds of personal information used and the kinds of decisions, split into those made solely by a program and those where a program does a substantial part.
- Give it an owner and a review date. New AI features arrive with every software update. Someone needs to check the register each quarter and update the policy when the picture changes.
This article is general information, not legal advice. Work with your legal adviser on the wording of your privacy policy.
Frequently asked questions
Does a person reviewing the output take a decision out of scope?
Not automatically. The OAIC guidance says a decision can be in scope even when the program's output is reviewed by a person or does not replace the whole decision. If the output shapes the decision, assume it counts.
Do AI features inside software we buy count?
Yes. If you arranged for a program to make or shape decisions about people, it does not matter whether you built it or a vendor did. Features switched on in your CRM, loan origination or HR system are in scope if they meet the test.
Does it only apply to AI?
No. The rule says "computer program". Rules engines, scoring models and automated workflows can all count, not just machine learning or generative AI.
Do we have to explain how our algorithms work?
No. The privacy policy describes the kinds of personal information used and the kinds of decisions involved. Commercial-in-confidence information about the systems is excluded.
What happens if we do not update our privacy policy?
The OAIC can investigate and take enforcement action, and the 2024 reforms gave it new powers, including infringement notices for some privacy policy failures. In practice, customers, partners and lenders asking what you have disclosed is the more immediate pressure.
Not sure which of your systems count?
In a free 30-minute session we start your AI register together. You keep it.
